What is the CVSS score of CVE-2025-52434?

CVE-2025-52434 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Java are affected by CVE-2025-52434?

Apache Tomcat instances using the APR/Native connector are vulnerable to a race condition that could allow attackers to cause service disruption or potential data corruption during HTTP/2 client…. A patch is available.

How to fix or mitigate CVE-2025-52434?

Within 24 hours: Identify all Tomcat instances in production and development using APR/Native connector and document current versions. Within 7 days: Test Tomcat 9.0.107 upgrade in non-production environment and develop rollback procedures. Within 30 days: Execute production upgrades during scheduled maintenance windows, prioritizing customer-facing and critical systems first.

Java CVE-2025-52434

EUVD-2025-21045 HIGH

Race Condition (CWE-362)

2025-07-10 security@apache.org

GHSA-4j3c-42xv-3f84

Denial Of Service Apache Java Race Condition Red Hat Tomcat Suse

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Ubuntu

MEDIUM

qualitative

SUSE

HIGH

qualitative

Red Hat

5.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 16, 2026 - 06:52 euvd

EUVD-2025-21045

Analysis Generated

Mar 16, 2026 - 06:52 vuln.today

CVE Published

Jul 10, 2025 - 19:15 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 maven packages depend on org.apache.tomcat.embed:tomcat-embed-core (3 direct, 0 indirect)
5 maven packages depend on org.apache.tomcat:tomcat-coyote (3 direct, 2 indirect)
10 maven packages depend on org.apache.tomcat:tomcat-util (8 direct, 2 indirect)

Ecosystem-wide dependent count for version 9.0.0.M1 and other introduced versions.

DescriptionCVE.org

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.

This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 9.0.107, which fixes the issue.

AnalysisAI

Apache Tomcat contains a race condition vulnerability in the APR/Native connector that can be triggered during concurrent HTTP/2 connection handling, particularly when clients initiate connection closes. The vulnerability affects Tomcat 9.0.0.M1 through 9.0.106 (and EOL versions 8.5.0-8.5.100), allowing remote unauthenticated attackers to cause denial of service through improper synchronization of shared resources. With a CVSS score of 7.5 and network-accessible attack vector requiring no authentication, this represents a high-severity availability impact, though no active public exploitation has been confirmed.

Technical ContextAI

The vulnerability exists in Apache Tomcat's APR/Native connector (libapr), which handles low-level network I/O operations. The race condition (CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization) occurs in the HTTP/2 protocol handler when multiple threads concurrently access shared connection state during client-initiated connection closure. HTTP/2's multiplexed streams and connection management increase the likelihood of race conditions if proper locking mechanisms are absent or insufficient. The APR connector directly interfaces with operating system network APIs (via libapr-1), making synchronization critical to prevent inconsistent state access. Affected CPE: cpe:2.3:a:apache:tomcat:9.0.0:m1:*:*:*:*:*:* through cpe:2.3:a:apache:tomcat:9.0.106:*:*:*:*:*:*:* and cpe:2.3:a:apache:tomcat:8.5.0:*:*:*:*:*:*:* through cpe:2.3:a:apache:tomcat:8.5.100:*:*:*:*:*:*:*

RemediationAI

Primary: Upgrade: Upgrade to Apache Tomcat 9.0.107 or later; details: Tomcat 9.0.107 includes fixes for the APR/Native connector race condition in HTTP/2 connection handling. Verify APR/Native connector is in use (check server.xml for Connector protocol='org.apache.coyote.http11.Http11AprProtocol' or HTTP/2 variant). Full release notes available at https://tomcat.apache.org/tomcat-9.0-doc/changelog.html Secondary: Workaround (if upgrade delayed): Disable APR/Native connector or revert to NIO/BIO connectors; details: Edit CATALINA_HOME/conf/server.xml and change Connector protocol from 'org.apache.coyote.http11.Http11AprProtocol' to 'org.apache.coyote.http11.Http11NioProtocol'. This avoids the vulnerable APR/Native code path but may impact performance. Restart Tomcat after modification. Tertiary: Mitigation: Implement connection pooling limits and monitoring; details: Restrict maxConnections and maxThreads in Connector configuration to reduce concurrent connection scenarios that could trigger race condition. Monitor for unexpected connection closures or server restarts in logs.

More in Java

View all

CVE-2012-4681 CRITICAL Emergency POC

9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m

CVE-2015-7450 CRITICAL Emergency POC

9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti

CVE-2013-2465 CRITICAL Act Now POC

9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent

CVE-2011-3544 CRITICAL Act Now POC

9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug

CVE-2010-1871 HIGH Act Now POC

8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to

CVE-2012-1723 CRITICAL Emergency POC

9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up

CVE-2013-0422 CRITICAL Emergency POC

9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using

CVE-2012-0507 CRITICAL Emergency POC

9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up

CVE-2015-4852 CRITICAL Act Now POC

9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL Act Now POC

9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow

CVE-2017-3066 CRITICAL Act Now POC

9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla

CVE-2012-0391 CRITICAL Act Now POC

9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-362 – Race Condition

View all

CVE-2023-36884 HIGH POC

7.5

CVE-2016-5195 HIGH POC

7.0

CVE-2017-1000112 HIGH POC

7.0

CVE-2014-0196 MEDIUM POC

5.5

CVE-2014-0226 MEDIUM POC

6.8

CVE-2016-1757 HIGH POC

7.0

CVE-2016-8655 HIGH POC

7.8

CVE-2015-5754 CRITICAL POC

9.3

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

Ubuntu

Priority: Medium

tomcat9

Release	Status	Version
noble	not-affected	9.0.70-2ubuntu0.1
plucky	not-affected	-
upstream	released	9.0.70-2
bionic	needed	-
focal	needed	-
jammy	needed	-
questing	not-affected	-

Debian

tomcat9

Release	Status	Fixed Version	Urgency
bullseye	fixed	9.0.107-0+deb11u1	-
bullseye (security)	fixed	9.0.107-0+deb11u2	-
bookworm	fixed	9.0.70-2	-
trixie	fixed	9.0.95-1	-
forky, sid	fixed	9.0.115-1	-
(unstable)	fixed	9.0.70-2	-

DLA-4244-1

SUSE

Severity: High

Product	Status
Container suse/manager/5.0/x86_64/server:5.0.5.1.7.33.2 Container suse/multi-linux-manager/5.1/x86_64/server:5.1.1.8.7.1 Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE	Affected
SUSE Enterprise Storage 7.1	Fixed
SUSE Liberty Linux 8	Fixed
SUSE Liberty Linux 9	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS	Fixed

CVE-2025-52434 vulnerability details – vuln.today

Back

Java CVE-2025-52434

Severity by source

CVSS VectorNVD

Lifecycle Timeline

Blast Radius

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Java

Same weakness CWE-362 – Race Condition

Same technique Denial Of Service

Vendor StatusVendor

Ubuntu

Debian

SUSE

Share

External POC / Exploit Code