Resource exhaustion in Apache Tomcat - CVE-2025-48976

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU111162

Resource exhaustion in Apache Tomcat - CVE-2025-48976

Published: June 16, 2025 / Updated: December 15, 2025


Vulnerability identifier: #VU111162
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-48976
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to Apache Commons FileUpload provided a hard-coded limit of 10kB for the size of the headers associated with a multipart request. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


Affected software

Apache Tomcat
Confluence Server
Debian Linux
Red Hat Enterprise Linux for IBM z Systems
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server - AUS
openEuler
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Jazz for Service Management
Log Analysis
IBM Cloud Transformation Advisor
Oracle Adapter for Eclipse RDF4J
IBM Security Guardium Key Lifecycle Manager (GKLM)
Crucible Server
EasyApache
Jira Service Management Server
IBM Watson Discovery for IBM Cloud Pak for Data
Jira Service Management Data Center
IBM Spectrum Control
Crowd Data Center
IBM Sterling B2B Integrator
IBM Sterling Secure Proxy
IBM Tivoli Business Service Manager
IBM Sterling Partner Engagement Manager
IBM Tivoli Netcool Impact
UCD - IBM UrbanCode Deploy
IBM Spectrum Symphony
IBM Maximo Asset Management
Confluence Data Center
Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition
IBM Tivoli Netcool/OMNIbus WebGUI
Oracle Financial Services Model Management and Governance
IBM Cloud Application Performance Management (APM)
IBM TXSeries for Multiplatforms
WebSphere Remote Server
IBM SPSS Collaboration and Deployment Services
WebSphere Service Registry and Repository
IBM Maximo Application Suite
Oracle Communications Session Report Manager
IBM Common Licensing
IBM Rational ClearCase
IBM Rational ClearQuest
Bamboo Server
Jira Software Data Center
IBM Transformation Extender Advanced
IBM Security Verify Governance
InfoSphere Master Data Management
Oracle Middleware Common Libraries and Tools
Oracle Banking Collections and Recovery
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
Oracle Communications Network Analytics Data Director
Oracle Communications Cloud Native Core Network Exposure Function
Oracle Communications Cloud Native Core Network Repository Function
Oracle Communications EAGLE Element Management System
IBM MQ Operator
IBM Tivoli Monitoring
IBM App Connect for Healthcare
Jazz Reporting Service
IBM Qradar SIEM
Jira Software Server
Oracle Hyperion Calculation Manager
Enterprise Application Runtimes
PowerVM NovaLink
Library Support for Struts
Cloudera Observability with IBM
DevOps Solution Workbench
Cloud Pak for Applications
WebSphere Hybrid Edition
DataStage on Cloud Pak for Data
Storage Scale
Oracle Hospitality OPERA 5 Property Services
IBM Security Directory Suite
Oracle Transportation Management
Engineering Test Management
Tivoli Composite Application Manager for Application Diagnostics
Oracle Business Intelligence Enterprise Edition
DevOps Deploy
Oracle Financial Services Analytical Applications Infrastructure
IBM InfoSphere Identity Insight
IBM OpenPages with Watson
IBM Business Automation Manager Open Editions
Maximo Application Suite - Monitor Component
Maximo Application Suite Ai Service
Maximo Application Suite - Predict Component
Total Storage Service Console (TSSC) / TS4500 IMC
IBM Engineering Requirements Management DOORS Next
Integration Bus for z/OS
Verify Identity Access Digital Credentials
DevOps Code ClearCase
ApplinX
Oracle Application Testing Suite
Oracle Communications Policy Management
Oracle Retail Xstore Point of Service
Business Automation Insights
Application Modernization Accelerator
Engineering Lifecycle Management - Jazz Foundation
Storage Protect Operations Center
Storage Protect Client
Storage Protect for Virtual Environments: Data Protection for VMware
Storage Protect for Space Management
Storage Protect for Virtual Environments: Data Protection for Hyper-V
CICS Transaction Gateway Desktop Edition
CICS Transaction Gateway for Multiplatforms
IBM supplied MQ Advanced container images
IBM Security Verify Directory
webMethods BPM
Guardium Data Protection
Apache Commons FileUpload
IBM Cloud Pak System
Oracle Communications Convergence
Oracle Communications Calendar Server
Oracle Communications Contacts Server
Oracle Utilities Application Framework
IBM Tivoli Application Dependency Discovery Manager
Oracle Communications Element Manager
Oracle Insurance Policy Administration
Oracle Fusion Middleware MapViewer
Oracle SOA Suite
Oracle Business Process Management Suite
Oracle Banking Trade Finance Process Management
Oracle Banking Corporate Lending Process Management
Oracle Banking Credit Facilities Process Management
Oracle Banking Virtual Account Management
Oracle Banking Supply Chain Finance
Oracle Banking Branch
Oracle Banking Liquidity Management
Oracle Banking Cash Management
Oracle Banking Origination
Stream Analytics
ExtremeControl for Site Engine
ExtremeAnalytics for Site Engine
IBM Sterling File Gateway
Crowd Server
Juniper Secure Analytics (JSA)
RSA Authentication Manager
Oracle FLEXCUBE Enterprise Limits and Collateral Management
IBM WebSphere Application Server
Oracle WebLogic Server
IBM WebSphere Application Server Liberty
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
apache-commons-fileupload
apache-commons-fileupload-help
tomcat-webapps
tomcat-servlet-4.0-api
tomcat-lib
tomcat-jsp-2.3-api
tomcat-el-3.0-api
tomcat-docs-webapp
tomcat-admin-webapps
tomcat
tomcat (Red Hat package)
tomcat9 (Red Hat package)
tomcat-jsvc
tomcat-help
tomcat-doc
tomcat10 (Debian package)
tomcat11 (Debian package)
Oracle Agile PLM Framework
Oracle REST Data Services
IBM CICS TX Advanced
IBM CICS TX Standard
IBM Security Verify Access
Oracle Commerce Platform
Oracle Retail Merchandising System
IBM InfoSphere Information Server
Oracle Service Bus
Oracle Documaker
Operational Decision Manager
Siebel Apps - Marketing
Primavera Unifier
Splunk AppDynamics Machine Agent
Splunk AppDynamics Analytics Agent
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Service Communication Proxy
Oracle Communications Cloud Native Core Unified Data Repository
IBM FileNet Content Manager

How to mitigate CVE-2025-48976

Install updates from vendor's website.

Apache Tomcat - addressed in versions 9.0.106, 10.1.42, 11.0.8
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.2.1
Apache Commons FileUpload - addressed in versions 1.6.0, 2.0.0-M4
Log Analysis - update to 1.3.8.2
PowerVM NovaLink - addressed in versions 2.1.1-251007, 2.2.1.1-251007, 2.3.1-251007
IBM Cloud Transformation Advisor - update to 4.4.0
IBM Cloud Pak System - update to 2.3.6.1
Cloudera Observability with IBM - update to 3.6.2
Crucible Server - update to 4.9.3
EasyApache - update to 4 25-20
Jira Service Management Server - addressed in versions 5.12.26, 10.3.10, 10.7.3, 11.2.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.2.1
Jira Service Management Data Center - addressed in versions 5.12.26, 10.3.10, 10.7.3, 11.2.0
DataStage on Cloud Pak for Data - update to 5.2.1
Storage Scale - addressed in versions 5.1.9.12, 5.2.1.0
IBM Spectrum Control - update to 5.4.13.2
Crowd Data Center - addressed in versions 6.2.5, 6.3.2, 7.1.3
IBM Sterling B2B Integrator - addressed in versions 6.1.2.7.2, 6.2.0.5.1, 6.2.1.1.1
IBM Sterling File Gateway - addressed in versions 6.2.0.4, 6.2.0.5.1, 6.2.1.1.1
IBM Sterling Secure Proxy - addressed in versions 6.1.0.3, 6.2.0.3, 6.2.1.2
IBM Tivoli Business Service Manager - update to 7.1.1.0
IBM Sterling Partner Engagement Manager - addressed in versions 6.2.3.5, 6.2.4.2
IBM Security Directory Suite - update to 8.0.1.24
Jazz Reporting Service - addressed in versions 7.0.2 iFix0036, 7.0.3 iFix022, 7.1 iFix009
Crowd Server - update to 7.1.3
IBM Tivoli Netcool Impact - update to 7.1.0.37
UCD - IBM UrbanCode Deploy - addressed in versions 7.1.2.25, 7.2.3.18, 7.3.2.13
IBM Spectrum Symphony - update to 7.3.2 FP3
Juniper Secure Analytics (JSA) - update to 7.5.0 UP12 IF03
IBM Qradar SIEM - update to 7.5.0 Update Pack 12 IF03
Confluence Server - addressed in versions 9.2.7, 9.5.3
Confluence Data Center - addressed in versions 9.2.7, 9.5.3
DevOps Deploy - addressed in versions 8.0.1.8, 8.1.2.1
RSA Authentication Manager - addressed in versions 8.8 Patch 2, 8.9 Patch 1
IBM Tivoli Netcool/OMNIbus WebGUI - update to 8.1.0.39
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.19
IBM TXSeries for Multiplatforms - update to 11.1.0.0 ifix12
IBM WebSphere Application Server - addressed in versions 8.5.5.29, 9.0.5.26
IBM Maximo Application Suite - addressed in versions 8.10.30, 8.11.27, 9.0.16, 9.1.5
IBM Business Automation Manager Open Editions - update to 9.2.1
IBM Common Licensing - update to 9.0.0.2
Maximo Application Suite - Monitor Component - update to 9.1.5
Maximo Application Suite Ai Service - update to 9.1.1
Maximo Application Suite - Predict Component - update to 9.1.3
Bamboo Server - addressed in versions 9.6.15, 10.2.6, 11.0.3
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.11
Jira Software Data Center - addressed in versions 9.12.26, 10.3.10, 10.7.3, 11.2.0
Jira Software Server - addressed in versions 9.12.26, 10.3.10, 10.7.3, 11.2.0
IBM Transformation Extender Advanced - addressed in versions 10.0.1.11, 10.0.2.1
IBM Security Verify Governance - update to 10.0.2.0.7
ApplinX - update to 11.1.0 Fix 5
IBM InfoSphere Information Server - update to 11.7.1.6 Service pack 1
Business Automation Insights - addressed in versions 24.0.0.0.5, 24.0.1.0.5, 25.0.0.0.2
IBM Cloud Pak for Business Automation - addressed in versions 24.0.1-IF006, 25.0.0-IF003
apache-commons-fileupload - update to 1.4-3
apache-commons-fileupload-help - update to 1.4-3
IBM MQ Operator - addressed in versions 3.2.19, 3.7.2, 9.4.4.0-r3
Application Modernization Accelerator - update to 4.4.0
IBM FileNet Content Manager - addressed in versions 5.5.8.0 IF010, 5.5.12.0 IF006, 5.6.0.0 IF004, 5.7.0.0 IF001
IBM Tivoli Monitoring - update to 6.3.0.7 Plus Service Pack 5
Engineering Lifecycle Management - Jazz Foundation - addressed in versions 7.0.3 iFix022, 7.1.0 iFix009
Storage Protect Operations Center - update to 8.1.27.100
Storage Protect Client - update to 8.2.1
Storage Protect for Virtual Environments: Data Protection for VMware - update to 8.2.1
Storage Protect for Space Management - update to 8.2.1
Storage Protect for Virtual Environments: Data Protection for Hyper-V - update to 8.2.1
Operational Decision Manager - addressed in versions 8.11.0.1 Interim fix 49, 8.11.1 Interim fix 47, 8.12.0.1 Interim fix 31, 9.0.0.1 Interim fix 15, 9.5.0.0 Interim fix 7
tomcat-webapps - addressed in versions 9.0.87-1, 9.0.115-1
tomcat-servlet-4.0-api - addressed in versions 9.0.87-1, 9.0.115-1
tomcat-lib - addressed in versions 9.0.87-1, 9.0.115-1
tomcat-jsp-2.3-api - addressed in versions 9.0.87-1, 9.0.115-1
tomcat-el-3.0-api - addressed in versions 9.0.87-1, 9.0.115-1
tomcat-docs-webapp - addressed in versions 9.0.87-1, 9.0.115-1
tomcat-admin-webapps - addressed in versions 9.0.87-1, 9.0.115-1
tomcat - addressed in versions 9.0.87-1, 9.0.115-1
tomcat (Red Hat package) - addressed in versions 9.0.87-1.el8_8.7, 9.0.87-1.el8_10.6, 9.0.87-1.el9_2.6, 9.0.87-3.el9_6.3, 10.1.36-1.el10_0.2
tomcat9 (Red Hat package) - update to 9.0.87-5.el10_0.3
tomcat - update to 9.0.100-5
tomcat-jsvc - update to 9.0.100-5
tomcat-help - update to 9.0.100-5
tomcat-doc - update to 9.0.115-1
CICS Transaction Gateway Desktop Edition - addressed in versions 9.2.0.2, 9.3.0.0, 10.1.0.0
CICS Transaction Gateway for Multiplatforms - addressed in versions 9.2.0.2, 9.3.0.0, 10.1.0.0
IBM supplied MQ Advanced container images - update to 9.4.4.0-r3
IBM Security Verify Directory - update to 10.0.4.3
IBM CICS TX Advanced - addressed in versions 10.1.0.0 ifix43, 11.1.0.0 ifix35
tomcat10 (Debian package) - addressed in versions 10.1.52-1~deb12u1, 10.1.52-1~deb13u1
webMethods BPM - addressed in versions 10.15 Fix 14, 11.1 Fix 2
tomcat11 (Debian package) - update to 11.0.15-1~deb13u1
IBM CICS TX Standard - update to 11.1.0.0 ifix36
Guardium Data Protection - addressed in versions 12.0p45, 12.0p125
IBM WebSphere Application Server Liberty - update to 25.0.0.9
Splunk AppDynamics Machine Agent - update to 25.7.0
Splunk AppDynamics Analytics Agent - update to 25.7.0
ExtremeControl for Site Engine - update to 25.8.10
ExtremeAnalytics for Site Engine - update to 25.8.10

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins