Resource exhaustion in Apache Tomcat - CVE-2025-48988

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU111161

Resource exhaustion in Apache Tomcat - CVE-2025-48988

Published: June 16, 2025 / Updated: June 20, 2025


Vulnerability identifier: #VU111161
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-48988
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling multipart requests. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


Affected software

Apache Tomcat
Debian Linux
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
Red Hat Enterprise Linux Server - AUS
openEuler
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Netcool Operations Insight
EasyApache
IBM Watson Discovery for IBM Cloud Pak for Data
Crowd Data Center
Jira Service Management Server
Jira Service Management Data Center
UCD - IBM UrbanCode Deploy
Bitbucket Data Center
Oracle Communications Session Report Manager
Jira Software Data Center
IBM Power Hardware Management Console (HMC)
Cloudera Observability with IBM
DevOps Solution Workbench
DevOps Deploy
IBM Business Automation Manager Open Editions
Maximo Application Suite Ai Service
IBM Engineering Requirements Management DOORS Next
CICS Transaction Gateway Desktop Edition
Integration Bus for z/OS
CICS Transaction Gateway for Multiplatforms
ApplinX
Oracle Communications Policy Management
watsonx Assistant Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
webMethods BPM
Communications Unified Assurance
Oracle Utilities Testing Accelerator
Cloudera Data Platform Private Cloud Base for IBM
Oracle Communications Element Manager
Juniper Secure Analytics (JSA)
IBM Qradar SIEM
Jira Software Server
Bitbucket Server
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
tomcat-webapps
tomcat
tomcat-admin-webapps
tomcat-docs-webapp
tomcat-el-3.0-api
tomcat-jsp-2.3-api
tomcat-lib
tomcat-servlet-4.0-api
tomcat (Red Hat package)
tomcat9 (Red Hat package)
tomcat-help
tomcat-jsvc
tomcat-doc
tomcat10 (Debian package)
tomcat11 (Debian package)
Siebel CRM End User

How to mitigate CVE-2025-48988

Install updates from vendor's website.

Apache Tomcat - addressed in versions 9.0.106, 10.1.42, 11.0.8
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.2.1
Netcool Operations Insight - update to 1.6.15
Cloudera Observability with IBM - update to 3.6.2
EasyApache - update to 4 25-20
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.2.1
Crowd Data Center - addressed in versions 6.0.10, 6.1.6, 6.2.5, 6.3.2
Jira Service Management Server - addressed in versions 5.12.25, 10.3.8, 10.7.2
Jira Service Management Data Center - addressed in versions 5.12.25, 10.3.8, 10.7.2
UCD - IBM UrbanCode Deploy - addressed in versions 7.1.2.25, 7.2.3.18, 7.3.2.13
Juniper Secure Analytics (JSA) - update to 7.5.0 UP12 IF03
IBM Qradar SIEM - update to 7.5.0 Update Pack 12 IF03
DevOps Deploy - addressed in versions 8.0.1.8, 8.1.2.1
Bitbucket Data Center - addressed in versions 8.19.21, 9.4.9, 9.6.5
Bitbucket Server - addressed in versions 8.19.21, 9.4.9, 9.6.5
IBM Business Automation Manager Open Editions - update to 9.2.1
Maximo Application Suite Ai Service - update to 9.1.1
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.11
Jira Software Data Center - addressed in versions 9.12.25, 10.3.8, 10.7.2
Jira Software Server - addressed in versions 9.12.25, 10.3.8, 10.7.2
IBM Power Hardware Management Console (HMC) - addressed in versions 10.3.1060.0 SP3, 11.1.1110.0
ApplinX - update to 11.1.0 Fix 5
Siebel CRM End User - update to 25.1
watsonx Assistant Cartridge - update to 5.2.1
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.2.1
tomcat-webapps - addressed in versions 9.0.87-1, 9.0.106-1
tomcat - addressed in versions 9.0.87-1, 9.0.106-1
tomcat-admin-webapps - addressed in versions 9.0.87-1, 9.0.106-1
tomcat-docs-webapp - addressed in versions 9.0.87-1, 9.0.106-1
tomcat-el-3.0-api - addressed in versions 9.0.87-1, 9.0.106-1
tomcat-jsp-2.3-api - addressed in versions 9.0.87-1, 9.0.106-1
tomcat-lib - addressed in versions 9.0.87-1, 9.0.106-1
tomcat-servlet-4.0-api - addressed in versions 9.0.87-1, 9.0.106-1
tomcat (Red Hat package) - addressed in versions 9.0.87-1.el8_8.7, 9.0.87-1.el8_10.6, 9.0.87-1.el9_2.6, 9.0.87-3.el9_6.3, 10.1.36-1.el10_0.2
tomcat9 (Red Hat package) - update to 9.0.87-5.el10_0.3
tomcat - addressed in versions 9.0.100-4, 9.0.100-6
tomcat-help - addressed in versions 9.0.100-4, 9.0.100-6
tomcat-jsvc - addressed in versions 9.0.100-4, 9.0.100-6
tomcat-doc - update to 9.0.106-1
tomcat10 (Debian package) - addressed in versions 10.1.52-1~deb12u1, 10.1.52-1~deb13u1
webMethods BPM - addressed in versions 10.15 Fix 14, 11.1 Fix 2
tomcat11 (Debian package) - update to 11.0.15-1~deb13u1

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins