EUVD-2025-21032
GHSA-25xr-qj8w-c4vf
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4Blast Radius
ecosystem impact- 4 maven packages depend on org.apache.tomcat.embed:tomcat-embed-core (4 direct, 0 indirect)
- 3 maven packages depend on org.apache.tomcat:tomcat-coyote (3 direct, 0 indirect)
Ecosystem-wide dependent count for version 8.5.0 and other introduced versions.
DescriptionNVD
Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.
AnalysisAI
A remote code execution vulnerability (CVSS 7.5). High severity vulnerability requiring prompt remediation.
Technical ContextAI
CWE-400 (Uncontrolled Resource Consumption). CVSS 7.5 indicates high severity.
RemediationAI
Monitor vendor channels for patch availability.
More from same product – last 7 days
Path traversal in Apache Ignite 2.0.0 through 2.17.0 lets authenticated REST API users read arbitrary files on the serve
Command injection in the shell-quote npm package allows attackers who can influence object-token inputs to inject arbitr
Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows unauthenticated remote attackers
Code execution via Groovy sandbox bypass in Apache Syncope 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0 allows a hig
Default configurations of Apache Shiro have a session fixation vulnerability. This issue affects Apache Shiro from 1.0
Vendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| jammy | DNE | - |
| noble | needed | - |
| upstream | released | 10.1.43 |
| plucky | ignored | end of life, was needed |
| questing | needed | - |
| Release | Status | Version |
|---|---|---|
| jammy | DNE | - |
| noble | DNE | - |
| plucky | DNE | - |
| upstream | released | 11.0.9 |
| questing | needed | - |
| Release | Status | Version |
|---|---|---|
| noble | not-affected | 9.0.70-2ubuntu0.1 |
| plucky | not-affected | - |
| upstream | released | 9.0.70-2 |
| bionic | needed | - |
| focal | needed | - |
| jammy | needed | - |
| questing | not-affected | - |
Debian
Bug #1109114| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bookworm | fixed | 10.1.52-1~deb12u1 | - |
| bookworm (security) | fixed | 10.1.52-1~deb12u1 | - |
| trixie (security), trixie | fixed | 10.1.52-1~deb13u1 | - |
| forky, sid | fixed | 10.1.52-1 | - |
| trixie | fixed | 10.1.52-1~deb13u1 | - |
| (unstable) | fixed | 10.1.46-1 | - |
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| trixie (security), trixie | fixed | 11.0.15-1~deb13u1 | - |
| forky, sid | fixed | 11.0.18-1 | - |
| trixie | fixed | 11.0.15-1~deb13u1 | - |
| (unstable) | fixed | 11.0.11-1 | - |
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | fixed | 9.0.107-0+deb11u1 | - |
| bullseye (security) | fixed | 9.0.107-0+deb11u2 | - |
| bookworm | fixed | 9.0.70-2 | - |
| trixie | fixed | 9.0.95-1 | - |
| forky, sid | fixed | 9.0.115-1 | - |
| (unstable) | fixed | 9.0.70-2 | - |
Share
External POC / Exploit Code
Leaving vuln.today