cbcvebase.
CVE-2025-48988
published 2025-06-16

CVE-2025-48988: Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from…

PriorityP262high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
53.28%
98.9th percentile
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Affected

10 ranges
VendorProductVersion rangeFixed in
apachetomcat>= 10.1.0 < 10.1.4210.1.42
apachetomcat>= 11.0.0 < 11.0.811.0.8
apachetomcat>= 9.0.0 < 9.0.1069.0.106
apache_software_foundationapache_tomcat10.1.0-M1 – 10.1.41
apache_software_foundationapache_tomcat11.0.0-M1 – 11.0.7
apache_software_foundationapache_tomcat8.5.0 – 8.5.100
apache_software_foundationapache_tomcat9.0.0.M1 – 9.0.105
debiantomcat10< tomcat10 10.1.52-1~deb12u1 (bookworm)tomcat10 10.1.52-1~deb12u1 (bookworm)
debiantomcat11< tomcat10 10.1.52-1~deb12u1 (bookworm)tomcat10 10.1.52-1~deb12u1 (bookworm)
debiantomcat9< tomcat10 10.1.52-1~deb12u1 (bookworm)tomcat10 10.1.52-1~deb12u1 (bookworm)

Detection & IOCsextracted from sources · hover to see the quote

  • The attack vector is a specially crafted HTTP multipart request containing an excessively large number of multipart sections, triggering excessive memory consumption and DoS on Apache Tomcat.
  • Monitor Apache Tomcat servers for HTTP multipart upload requests with an abnormally high number of multipart sections, which may indicate exploitation attempts.
  • ·Affected Apache Tomcat versions span multiple branches: 9.0.0.M1–9.0.105, 10.1.0-M1–10.1.41, 11.0.0-M1–11.0.7, and EOL branch 8.5.0–8.5.100. Fixed versions are 9.0.106, 10.1.42, and 11.0.8.
  • ·No mitigation short of upgrading is available per Red Hat Product Security criteria; many downstream packages have fixes deferred.

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_oracle7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.