Apache Tomcat may send a response that redirects a client to an arbitrary URL when a request with certain parameters is processed by the LoadBalancerDrainingValve. This open redirect behavior can be exploited by an attacker to send unsuspecting users to a malicious destination, which can lead to phishing, credential theft or drive‑by attacks. The weakness is a form of redirect manipulation and is classified as CWE‑601.

Apache Tomcat versions from 8.5.30 through 8.5.100, 9.0.0.M23 through 9.0.115, 10.1.0-M1 through 10.1.52, and 11.0.0-M1 through 11.0.18 are affected. Any older or unsupported releases may also be vulnerable.

The CVSS base score is 6.1, indicating a moderate severity. The EPSS score is less than 1 %, implying a low probability of exploit, and the vulnerability is not listed by CISA as a known exploited vulnerability. Exploitation would require sending a crafted HTTP request to the Tomcat instance possessing the LoadBalancerDrainingValve; the redirect is not automatically triggered but occurs only under specific request conditions.