A flaw in Apache Tomcat's LoadBalancerDrainingValve permits an attacker to cause the server to redirect HTTP requests to arbitrary URLs. The vulnerability can be exploited by supplying a crafted query string that instructs the valve to forward the request to an untrusted domain, leading to phishing or malicious content. This falls under CWE-601, an open redirect weakness that primarily jeopardizes user trust and can assist in credential theft or drive‑by attacks.

The issue spans multiple Tomcat releases. Users running Apache Tomcat 11.x from 11.0.0-M1 through 11.0.18, 10.x from 10.1.0-M1 through 10.1.52, 9.x from 9.0.0.M23 through 9.0.115, and 8.5.x from 8.5.30 through 8.5.100 are affected. Unsupported or older versions may also be vulnerable. The official recommendation is to upgrade to 11.0.20, 10.1.53, or 9.0.116 where the issue is resolved.

The CVSS score is not provided and EPSS data is missing, indicating no current exploitation evidence, while the vulnerability is absent from the CISA KEV list. Nevertheless, because open redirects are a common manipulation vector, the risk is considered moderate until mitigated. Attackers would need network access to the Tomcat instance and to trigger the LoadBalancerDrainingValve, typically via a crafted HTTP request. After exploitation, the redirect can lure users to malicious destinations, potentially enabling phishing, credential theft, or malware delivery.