What is the CVSS score of CVE-2025-48988?

CVE-2025-48988 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Tomcat are affected by CVE-2025-48988?

Apache Tomcat versions 8.5.0-11.0.7 contain a resource exhaustion vulnerability that could allow attackers to consume server resources without limits, potentially causing denial of service.. A patch is available.

How to fix or mitigate CVE-2025-48988?

Within 24 hours: Inventory all Tomcat instances and document current versions; assess whether affected versions are in production. Within 7 days: Develop and test patching plan for affected systems; prioritize production environments. Within 30 days: Complete deployment of Tomcat 9.0.106, 10.1.42, or 11.0.8 across all affected systems; verify patches in staging before production rollout.

Tomcat CVE-2025-48988

EUVD-2025-18409 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2025-06-16 security@apache.org

GHSA-h3gc-qfqq-6h8f

Apache Tomcat Denial Of Service Java Red Hat Suse

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Ubuntu

MEDIUM

qualitative

SUSE

HIGH

qualitative

Red Hat

5.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 14, 2026 - 21:59 euvd

EUVD-2025-18409

Analysis Generated

Mar 14, 2026 - 21:59 vuln.today

CVE Published

Jun 16, 2025 - 15:15 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 maven packages depend on org.apache.tomcat.embed:tomcat-embed-core (2 direct, 0 indirect)
2 maven packages depend on org.apache.tomcat:tomcat-catalina (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 11.0.0-M1 and other introduced versions.

DescriptionCVE.org

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

AnalysisAI

A remote code execution vulnerability in Apache Tomcat (CVSS 7.5). High severity vulnerability requiring prompt remediation.

Technical ContextAI

Vulnerability type: remote code execution. CVSS 7.5 indicates high severity. Affects Apache Tomcat.

RemediationAI

Monitor vendor channels for patch availability.

More in Tomcat

View all

CVE-2017-12617 HIGH Act Now POC

8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT

CVE-2016-8735 CRITICAL Act Now POC

9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8

CVE-2017-12615 HIGH Act Now POC

8.1 Sep 19

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this

CVE-2014-0050 HIGH Act Now POC

7.5 Apr 01

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products,

CVE-2017-12616 HIGH Act Now

7.5 Sep 19

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or

CVE-2014-0227 MEDIUM This Month

6.4 Feb 16

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and

CVE-2013-5528 MEDIUM This Month POC

4.0 Oct 11

Directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager all

CVE-2016-6808 CRITICAL Emergency POC

9.8 Apr 12

Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42. Rated critical severity (CVSS 9.8), this vulnerabili

CVE-2016-1240 HIGH Act Now POC

7.8 Oct 03

The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debia

CVE-2016-5425 HIGH Act Now POC

7.8 Oct 13

The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distribu

CVE-2022-22965 CRITICAL Act Now POC

9.8 Apr 01

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

CVE-2025-31650 HIGH Act Now POC

7.5 Apr 28

Improper Input Validation vulnerability in Apache Tomcat. Rated high severity (CVSS 7.5), this vulnerability is remotely

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all

CVE-2017-8779 HIGH POC

7.5

CVE-2025-53521 CRITICAL POC

9.3

CVE-2017-5850 HIGH POC

7.5

CVE-2025-26682 HIGH

7.5

CVE-2025-26466 MEDIUM

5.9

CVE-2020-37067 CRITICAL POC

9.8

CVE-2021-47875 CRITICAL POC

9.8

CVE-2023-38507 CRITICAL POC

9.8

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

Ubuntu

Priority: Medium

tomcat10

Release	Status	Version
jammy	DNE	-
oracular	ignored	end of life, was needs-triage
noble	needed	-
upstream	released	10.1.42
plucky	ignored	end of life, was needed
questing	needed	-

tomcat11

Release	Status	Version
jammy	DNE	-
noble	DNE	-
oracular	DNE	-
plucky	DNE	-
upstream	released	11.0.8
questing	needed	-

tomcat9

Release	Status	Version
noble	not-affected	9.0.70-2ubuntu0.1
oracular	not-affected	-
plucky	not-affected	-
upstream	released	9.0.70-2
bionic	needed	-
focal	needed	-
jammy	needed	-
questing	not-affected	-

Debian

Bug #1108117

tomcat10

Release	Status	Fixed Version	Urgency
bookworm	fixed	10.1.52-1~deb12u1	-
bookworm (security)	fixed	10.1.52-1~deb12u1	-
trixie (security), trixie	fixed	10.1.52-1~deb13u1	-
forky, sid	fixed	10.1.52-1	-
trixie	fixed	10.1.52-1~deb13u1	-
(unstable)	fixed	10.1.46-1	-

tomcat11

Release	Status	Fixed Version	Urgency
trixie (security), trixie	fixed	11.0.15-1~deb13u1	-
forky, sid	fixed	11.0.18-1	-
trixie	fixed	11.0.15-1~deb13u1	-
(unstable)	fixed	11.0.11-1	-

tomcat9

Release	Status	Fixed Version	Urgency
bullseye	fixed	9.0.107-0+deb11u1	-
bullseye (security)	fixed	9.0.107-0+deb11u2	-
bookworm	fixed	9.0.70-2	-
trixie	fixed	9.0.95-1	-
forky, sid	fixed	9.0.115-1	-
(unstable)	fixed	9.0.70-2	-

DLA-4244-1 DSA-6120-1 DSA-6121-1

SUSE

Severity: High

Product	Status
Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1 Container suse/multi-linux-manager/5.1/x86_64/server:5.1.0.6.40 Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE	Affected
SUSE Enterprise Storage 7.1	Fixed
SUSE Liberty Linux 8	Fixed
SUSE Liberty Linux 9	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS	Fixed

CVE-2025-48988 vulnerability details – vuln.today

Back

Tomcat CVE-2025-48988

Severity by source

CVSS VectorNVD

Lifecycle Timeline

Blast Radius

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Tomcat

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

Same technique Denial Of Service

Vendor StatusVendor

Ubuntu

Debian

SUSE

Share

External POC / Exploit Code