Resource exhaustion in Apache Tomcat - CVE-2025-61795

Vulnerability identifier: #VU117682

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-61795

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling errors while processing multipart upload. Depending on JVM settings, application memory usage and application load, it is possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.

Apache Tomcat
SUSE Manager Server 4.3
SUSE Linux Enterprise Server 15 SP5
Debian Linux
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Manager Server
SUSE Enterprise Storage
Web and Scripting Module
openSUSE Leap
openEuler
DataPower Operations Dashboard
Storage Defender Copy Data Management
Guardium Data Security Center (GDSC)
UrbanCode Build
DevOps
Maximo Application Suite Ai Service
IBM Engineering Requirements Management DOORS Next
CICS Transaction Gateway for Multiplatforms
CICS Transaction Gateway Desktop Edition
Integration Bus for z/OS
ApplinX
Oracle Communications Policy Management
Oracle Retail Xstore Point of Service
Big Replicate LiveData Migrator
DevOps Deploy
Storage Protect Plus Server
IBM Observability with Instana
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
Oracle Financial Services Model Management and Governance
Oracle Communications Session Report Manager
Oracle Graph Server and Client
Oracle Communications EAGLE Element Management System
UCD - IBM UrbanCode Deploy
IBM Power Hardware Management Console (HMC)
Communications Unified Assurance
IBM Qradar SIEM
Juniper Secure Analytics (JSA)
Oracle Communications Element Manager
Oracle Commerce Guided Search
tomcat
tomcat-admin-webapps
tomcat-javadoc
tomcat-el-3_0-api
tomcat-lib
tomcat-webapps
tomcat-jsp-2_3-api
tomcat-docs-webapp
tomcat-servlet-4_0-api
tomcat-help
tomcat-jsvc
tomcat-embed
tomcat (Red Hat package)
tomcat10-embed
tomcat10-el-5_0-api
tomcat10-servlet-6_0-api
tomcat10-admin-webapps
tomcat10
tomcat10-webapps
tomcat10-lib
tomcat10-docs-webapp
tomcat10-doc
tomcat10-jsp-3_1-api
tomcat10-jsvc
tomcat10 (Debian package)
tomcat11-embed
tomcat11-docs-webapp
tomcat11-jsvc
tomcat11-servlet-6_1-api
tomcat11
tomcat11-doc
tomcat11-admin-webapps
tomcat11-el-6_0-api
tomcat11-webapps
tomcat11-jsp-4_0-api
tomcat11-lib
tomcat11 (Debian package)

Install updates from vendor's website.

Apache Tomcat - addressed in versions 9.0.110, 10.1.47, 11.0.12
DataPower Operations Dashboard - update to 1.0.23.3
IBM Observability with Instana - update to 1.0.309
Storage Defender Copy Data Management - update to 2.3.0
Guardium Data Security Center (GDSC) - update to 3.8.5
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.3.1
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.0
DevOps - update to 7.1.0.2
IBM Qradar SIEM - update to 7.5.0 Update Pack 14 IF01
Juniper Secure Analytics (JSA) - update to 7.5.0 UP14 IF01
Maximo Application Suite Ai Service - update to 9.1.10
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.11
ApplinX - update to 11.1.0 Fix 8
Big Replicate LiveData Migrator - update to 3.4
UCD - IBM UrbanCode Deploy - addressed in versions 7.1.2.28, 7.2.3.21, 7.3.2.16
DevOps Deploy - addressed in versions 8.0.1.11, 8.1.2.4, 8.2.0.0
tomcat - addressed in versions 9.0.36-3.153.2, 9.0.111-150200.96.1
tomcat-admin-webapps - addressed in versions 9.0.36-3.153.2, 9.0.111-150200.96.1
tomcat-javadoc - addressed in versions 9.0.36-3.153.2, 9.0.111-150200.96.1
tomcat-el-3_0-api - addressed in versions 9.0.36-3.153.2, 9.0.111-150200.96.1
tomcat-lib - addressed in versions 9.0.36-3.153.2, 9.0.111-150200.96.1
tomcat-webapps - addressed in versions 9.0.36-3.153.2, 9.0.111-150200.96.1
tomcat-jsp-2_3-api - addressed in versions 9.0.36-3.153.2, 9.0.111-150200.96.1
tomcat-docs-webapp - addressed in versions 9.0.36-3.153.2, 9.0.111-150200.96.1
tomcat-servlet-4_0-api - addressed in versions 9.0.36-3.153.2, 9.0.111-150200.96.1
tomcat-help - update to 9.0.100-9
tomcat - update to 9.0.100-9
tomcat-jsvc - update to 9.0.100-9
tomcat-embed - update to 9.0.111-150200.96.1
tomcat-jsvc - update to 9.0.111-150200.96.1
Storage Protect Plus Server - update to 10.1.18
tomcat (Red Hat package) - update to 10.1.36-1.el10_0.3
tomcat10-embed - update to 10.1.48-150200.5.54.1
tomcat10-el-5_0-api - update to 10.1.48-150200.5.54.1
tomcat10-servlet-6_0-api - update to 10.1.48-150200.5.54.1
tomcat10-admin-webapps - update to 10.1.48-150200.5.54.1
tomcat10 - update to 10.1.48-150200.5.54.1
tomcat10-webapps - update to 10.1.48-150200.5.54.1
tomcat10-lib - update to 10.1.48-150200.5.54.1
tomcat10-docs-webapp - update to 10.1.48-150200.5.54.1
tomcat10-doc - update to 10.1.48-150200.5.54.1
tomcat10-jsp-3_1-api - update to 10.1.48-150200.5.54.1
tomcat10-jsvc - update to 10.1.48-150200.5.54.1
tomcat10 (Debian package) - addressed in versions 10.1.52-1~deb12u1, 10.1.52-1~deb13u1
IBM Power Hardware Management Console (HMC) - addressed in versions 10.3.1063.2, 11.1.1111.5
tomcat11-embed - update to 11.0.13-150600.13.12.1
tomcat11-docs-webapp - update to 11.0.13-150600.13.12.1
tomcat11-jsvc - update to 11.0.13-150600.13.12.1
tomcat11-servlet-6_1-api - update to 11.0.13-150600.13.12.1
tomcat11 - update to 11.0.13-150600.13.12.1
tomcat11-doc - update to 11.0.13-150600.13.12.1
tomcat11-admin-webapps - update to 11.0.13-150600.13.12.1
tomcat11-el-6_0-api - update to 11.0.13-150600.13.12.1
tomcat11-webapps - update to 11.0.13-150600.13.12.1
tomcat11-jsp-4_0-api - update to 11.0.13-150600.13.12.1
tomcat11-lib - update to 11.0.13-150600.13.12.1
tomcat11 (Debian package) - update to 11.0.15-1~deb13u1

• https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.12
• https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.110
• https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.47
• https://lists.apache.org/thread/3d67dlv034g8qjpo86p7814wctb0dpfz

• Remote denial of service in Apache Tomcat
• openEuler 24.03 LTS SP1 update for tomcat
• openEuler 22.03 LTS SP4 update for tomcat
• openEuler 22.03 LTS SP3 update for tomcat
• openEuler 20.03 LTS SP4 update for tomcat
• openEuler 24.03 LTS SP2 update for tomcat
• openEuler 24.03 LTS update for tomcat
• SUSE update for tomcat11
• SUSE update for tomcat10
• Multiple vulnerabilities in IBM Integration Bus for z/OS
• SUSE update for tomcat
• SUSE update for tomcat
• Multiple vulnerabilities in IBM QRadar SIEM
• IBM ApplinX update for Apache Tomcat
• Multiple vulnerabilities in IBM Guardium Data Security Center
• Red Hat Enterprise Linux 10 update for tomcat
• Multiple vulnerabilities in IBM Observability with Instana
• Multiple vulnerabilities in IBM DevOps Deploy / IBM UrbanCode Deploy (UCD)
• Multiple vulnerabilities in IBM Maximo AI Service
• Resource exhaustion in Oracle Graph Server and Client
• Multiple vulnerabilities in Oracle Communications Element Manager
• Multiple vulnerabilities in Oracle Communications Session Report Manager
• Multiple vulnerabilities in Oracle Communications Policy Management
• Multiple vulnerabilities in Communications Unified Assurance
• Multiple vulnerabilities in Oracle Financial Services Model Management and Governance
• Multiple vulnerabilities in Oracle Commerce Guided Search
• Resource exhaustion in Oracle Retail Xstore Point of Service
• Debian update for tomcat10
• Debian update for tomcat11
• Multiple vulnerabilities in IBM Watson Discovery Cartridge
• Juniper Secure Analytics update for third-party components
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge
• Multiple vulnerabilities in IBM DevOps Build
• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS and DOORS Web Access
• IBM DataPower Operations Dashboard update for Apache Tomcat
• Multiple vulnerabilities in IBM Power Hardware Management Console (HMC)
• Multiple vulnerabilities in IBM Storage Protect Plus Server
• Multiple vulnerabilities in IBM Storage Defender Copy Data Management
• Multiple vulnerabilities in Oracle Communications EAGLE Element Management System
• Multiple vulnerabilities in IBM Big Replicate LiveData Migrator
• Multiple vulnerabilities in IBM CICS Transaction Gateway for Multiplatforms
• Multiple vulnerabilities in CICS Transaction Gateway Desktop Edition