CVE-2025-48988

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.(CVE-2025-48988)

Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.(CVE-2025-49125)

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

A vulnerability, which was classified as problematic, has been found in Apache Tomcat up to 9.0.105/10.1.41/11.0.7 (Application Server Software).Using CWE to declare the problem leads to CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.Impacted is availability.Upgrading to version 9.0.106, 10.1.42 or 11.0.8 eliminates this vulnerability.(CVE-2025-48988)

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.

This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 9.0.107, which fixes the issue.(CVE-2025-52434)

For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.(CVE-2025-52520)

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.(CVE-2025-53506)

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

• tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

• tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

• apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

• tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)

• tomcat: Apache Tomcat denial of service (CVE-2025-52520)

• tomcat: Apache Tomcat denial of service (CVE-2025-52434)

• tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

• tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

• tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

• apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

• tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)

• tomcat: Apache Tomcat denial of service (CVE-2025-52520)

• tomcat: Apache Tomcat denial of service (CVE-2025-52434)

• tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

• tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

• tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

• apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

• tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)

• tomcat: Apache Tomcat denial of service (CVE-2025-52520)

• tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

• tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

• tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

• apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

• tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)

• tomcat: Apache Tomcat denial of service (CVE-2025-52520)

• tomcat: Apache Tomcat denial of service (CVE-2025-52434)

• tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2025-48988 in the org.apache.tomcat:tomcat-catalina package for Root:Maven. Multiple fixed versions available.

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

• tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
• tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
• apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
• tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
• tomcat: Apache Tomcat denial of service (CVE-2025-52520)
• tomcat: Apache Tomcat denial of service (CVE-2025-52434)
• tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

• tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
• tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
• apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
• tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
• tomcat: Apache Tomcat denial of service (CVE-2025-52520)
• tomcat: Apache Tomcat denial of service (CVE-2025-52434)
• tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

• tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
• tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
• apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
• tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
• tomcat: Apache Tomcat denial of service (CVE-2025-52520)
• tomcat: Apache Tomcat denial of service (CVE-2025-52434)
• tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.0 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

TuxCare rebuilt 3 packages to address 10 CVEs. Fixed in 8.5.100.tuxcare.1.

TuxCare rebuilt 5 packages to address 18 CVEs. Fixed in 9.0.75-tuxcare.1.

TuxCare rebuilt 6 packages to address 18 CVEs. Fixed in 9.0.83-tuxcare.1.

TuxCare rebuilt 4 packages to address 10 CVEs. Fixed in 9.0.90-tuxcare.1.

TuxCare rebuilt 5 packages to address 18 CVEs. Fixed in 9.0.50-tuxcare.2.

TuxCare rebuilt 3 packages to address 2 CVEs. Fixed in 9.0.100-tuxcare.2.

TuxCare rebuilt 6 packages to address 22 CVEs. Fixed in 10.1.18-tuxcare.1.

TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 9.0.87-tuxcare.5.

TuxCare rebuilt 4 packages to address 3 CVEs. Fixed in 9.0.46-tuxcare.4.

• CVE-2025-48988: limit number and header size of multipart parts
• CVE-2025-52520: use Math.addExact and long postSize to prevent overflow bypass of maxPostSize during multipart upload

TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 7.0.109-tuxcare.3.

TuxCare rebuilt 8 packages to address 32 CVEs. Fixed in 9.0.24-tuxcare.1.

TuxCare rebuilt 7 packages to address 24 CVEs. Fixed in 8.5.46-tuxcare.1.

TuxCare rebuilt 5 packages to address 26 CVEs. Fixed in 9.0.39-tuxcare.2.

TuxCare rebuilt 7 packages to address 22 CVEs. Fixed in 9.0.13-tuxcare.2.

TuxCare rebuilt 4 packages to address 6 CVEs. Fixed in 7.0.70-tuxcare.6.

TuxCare rebuilt 5 packages to address 8 CVEs. Fixed in 10.1.33-tuxcare.3.

FileUpload large number of parts with headers DoS. (CVE-2025-48988) Security constraint bypass for pre/post-resources. (CVE-2025-49125)

These are all security issues fixed in the tomcat-9.0.106-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the tomcat10-10.1.42-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the tomcat11-11.0.8-1.1 package on the GA media of openSUSE Tumbleweed.

This update for tomcat fixes the following issues:

• CVE-2025-46701: Refactored CGI servlet to access resources via WebResources (bsc#1243815).
• CVE-2025-48988: Limited the total number of parts in a multi-part request and limits the size of the headers provided with each part (bsc#1244656).
• CVE-2025-49125: Expand checks for webAppMount (bsc#1244649).

This update for tomcat10 fixes the following issues:

• Fixed refactor CGI servlet to access resources via WebResources (bsc#1243815).
• Fixed limits the total number of parts in a multi-part request and limits the size of the headers provided with each part (bsc#1244656).
• Fixed expand checks for webAppMount (bsc#1244649).
• Hardening permissions (bsc#1242722)

Update to Tomcat 10.1.42:

• Fixed CVEs:

  • CVE-2025-46701: refactor CGI servlet to access resources via WebResources (bsc#1243815)
  • CVE-2025-48988: limits the total number of parts in a multi-part request and limits the size of the headers provided with each part (bsc#1244656)
  • CVE-2025-49125: Expand checks for webAppMount (bsc#1244649)

• Catalina:

  • Add: Support for the java:module namespace which mirrors the java:comp namespace.
  • Add: Support parsing of multiple path parameters separated by ; in a single URL segment. Based on pull request #860 by Chenjp.
  • Add: Support for limiting the number of parameters in HTTP requests through the new ParameterLimitValve. The valve allows configurable URL-specific limits on the number of parameters.
  • Fix: 69699: Encode redirect URL used by the rewrite valve with the session id if appropriate, and handle cross context with different session configuration when using rewrite.
  • Add: #863: Support for comments at the end of lines in text rewrite map files to align behaviour with Apache httpd. Pull request provided by Chenjp.
  • Fix: 69706: Saved request serialization issue in FORM introduced when allowing infinite session timeouts.
  • Fix: Expand the path checks for Pre-Resources and Post-Resources mounted at a path within the web application.
  • Fix: Use of SSS in SimpleDateFormat pattern for AccessLogValve.
  • Fix: Process possible path parameters rewrite production in the rewrite valve.
  • Fix: 69588: Enable allowLinking to be set on PreResources, JarResources and PostResources. If not set explicitly, the setting will be inherited from the Resources.
  • Add: 69633: Support for Filters using context root mappings.
  • Fix: 69643: Optimize directory listing for large amount of files. Patch submitted by Loic de l'Eprevier.
  • Fix: #843: Off by one validation logic for partial PUT ranges and associated test case. Submitted by Chenjp.
  • Refactor: Replace the unused buffer in org.apache.catalina.connector.InputBuffer with a static, zero length buffer.
  • Refactor: GCI servlet to access resources via the WebResource API.
  • Fix: 69662: Report name in exception message when a naming lookup failure occurs. Based on code submitted by Donald Smith.
  • Fix: Ensure that the FORM authentication attribute authenticationSessionTimeout works correctly when sessions have an infinite timeout when authentication starts.
  • Add: Provide a content type based on file extension when web application resources are accessed via a URL.

• Coyote

  • Refactor: #861: TaskQueue to use the new interface RetryableQueue which enables better integration of custom Executors which provide their own BlockingQueue implementation. Pull request provided by Paulo Almeida.
  • Add: Finer grained control of multi-part request processing via two new attributes on the Connector element. maxPartCount limits the total number of parts in a multi-part request and maxPartHeaderSize limits the size of the headers provided with each part. Add support for these new attributes to the ParameterLimitValve.
  • Refactor: The SavedRequestInputFilter so the buffered data is used directly rather than copied.

• Jasper:

  • Fix: 69696: Mark the JSP wrapper for reload after a failed compilation.
  • Fix: 69635: Add support to jakarta.el.ImportHandler for resolving inner classes.
  • Add:…