What is the CVSS score of EUVD-2025-21032?

EUVD-2025-21032 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Java are affected by EUVD-2025-21032?

Apache Tomcat versions 8.5 through 11.0 contain a vulnerability that allows attackers to exhaust server resources through malformed HTTP/2 requests, potentially causing service degradation or…. A patch is available.

How to fix or mitigate EUVD-2025-21032?

Within 24 hours: Inventory all systems running Tomcat versions 8.5.0-11.0.8 and assess exposure to untrusted HTTP/2 clients. Within 7 days: Implement compensating controls (disable HTTP/2 or apply WAF rules filtering non-compliant HTTP/2 handshakes) on critical systems. Within 30 days: Upgrade all affected Tomcat instances to versions 11.0.9, 10.1.43, or 9.0.107.

Java EUVD-2025-21032

| CVE-2025-53506 HIGH

Uncontrolled Resource Consumption (CWE-400)

2025-07-10 security@apache.org

GHSA-25xr-qj8w-c4vf

Denial Of Service Apache Java Red Hat Tomcat Suse

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Ubuntu

MEDIUM

qualitative

SUSE

HIGH

qualitative

Red Hat

5.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 16, 2026 - 06:52 euvd

EUVD-2025-21032

Analysis Generated

Mar 16, 2026 - 06:52 vuln.today

CVE Published

Jul 10, 2025 - 20:15 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

4 maven packages depend on org.apache.tomcat.embed:tomcat-embed-core (4 direct, 0 indirect)
3 maven packages depend on org.apache.tomcat:tomcat-coyote (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 8.5.0 and other introduced versions.

DescriptionCVE.org

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

AnalysisAI

A remote code execution vulnerability (CVSS 7.5). High severity vulnerability requiring prompt remediation.

Technical ContextAI

CWE-400 (Uncontrolled Resource Consumption). CVSS 7.5 indicates high severity.

RemediationAI

Monitor vendor channels for patch availability.

More in Java

View all

CVE-2012-4681 CRITICAL Emergency POC

9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m

CVE-2015-7450 CRITICAL Emergency POC

9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti

CVE-2013-2465 CRITICAL Act Now POC

9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent

CVE-2011-3544 CRITICAL Act Now POC

9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug

CVE-2010-1871 HIGH Act Now POC

8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to

CVE-2012-1723 CRITICAL Emergency POC

9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up

CVE-2013-0422 CRITICAL Emergency POC

9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using

CVE-2012-0507 CRITICAL Emergency POC

9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up

CVE-2015-4852 CRITICAL Act Now POC

9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL Act Now POC

9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow

CVE-2017-3066 CRITICAL Act Now POC

9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla

CVE-2012-0391 CRITICAL Act Now POC

9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all

CVE-2023-44487 HIGH POC

7.5

CVE-2026-45498 HIGH POC

7.5

CVE-2016-8610 HIGH

7.5

CVE-2026-28318 HIGH POC

7.5

7.5

7.5

7.5

7.5

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

Ubuntu

Priority: Medium

tomcat10

Release	Status	Version
jammy	DNE	-
noble	needed	-
upstream	released	10.1.43
plucky	ignored	end of life, was needed
questing	needed	-

tomcat11

Release	Status	Version
jammy	DNE	-
noble	DNE	-
plucky	DNE	-
upstream	released	11.0.9
questing	needed	-

tomcat9

Release	Status	Version
noble	not-affected	9.0.70-2ubuntu0.1
plucky	not-affected	-
upstream	released	9.0.70-2
bionic	needed	-
focal	needed	-
jammy	needed	-
questing	not-affected	-

Debian

Bug #1109114

tomcat10

Release	Status	Fixed Version	Urgency
bookworm	fixed	10.1.52-1~deb12u1	-
bookworm (security)	fixed	10.1.52-1~deb12u1	-
trixie (security), trixie	fixed	10.1.52-1~deb13u1	-
forky, sid	fixed	10.1.52-1	-
trixie	fixed	10.1.52-1~deb13u1	-
(unstable)	fixed	10.1.46-1	-

tomcat11

Release	Status	Fixed Version	Urgency
trixie (security), trixie	fixed	11.0.15-1~deb13u1	-
forky, sid	fixed	11.0.18-1	-
trixie	fixed	11.0.15-1~deb13u1	-
(unstable)	fixed	11.0.11-1	-

tomcat9

Release	Status	Fixed Version	Urgency
bullseye	fixed	9.0.107-0+deb11u1	-
bullseye (security)	fixed	9.0.107-0+deb11u2	-
bookworm	fixed	9.0.70-2	-
trixie	fixed	9.0.95-1	-
forky, sid	fixed	9.0.115-1	-
(unstable)	fixed	9.0.70-2	-

DLA-4244-1 DSA-6120-1 DSA-6121-1

SUSE

Severity: High

Product	Status
Container suse/manager/5.0/x86_64/server:5.0.5.1.7.33.2 Container suse/multi-linux-manager/5.1/x86_64/server:5.1.1.8.7.1 Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE	Affected
SUSE Enterprise Storage 7.1	Fixed
SUSE Liberty Linux 8	Fixed
SUSE Liberty Linux 9	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS	Fixed

EUVD-2025-21032 vulnerability details – vuln.today

Back

Java EUVD-2025-21032

Severity by source

CVSS VectorNVD

Lifecycle Timeline

Blast Radius

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Java

Same weakness CWE-400 – Uncontrolled Resource Consumption

Same technique Denial Of Service

Vendor StatusVendor

Ubuntu

Debian

SUSE

Share

External POC / Exploit Code