IBM ApplinX update for Apache Tomcat

1) Resource exhaustion

EUVDB-ID: #VU117682

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-61795

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling errors while processing multipart upload. Depending on JVM settings, application memory usage and application load, it is possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.

Mitigation

Install update from vendor's website.

Vulnerable software versions

ApplinX: 11.1 - 11.1.0 Fix 7

CPE2.3

• cpe:2.3:a:ibm_corporation:applinx:11.1:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:applinx:11.1.0:Fix 1:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:applinx:11.1.0:Fix 2:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7253399

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.