Vulnerability

CERT-In Vulnerability Note CIVN-2025-0177
Denial of Service Vulnerability in Apache Tomcat

Original Issue Date:August 14, 2025

Severity Rating: CRITICAL

Software Affected

Apache Tomcat versions 9.0.0.M1 through 9.0.107
Apache Tomcat versions 10.1.0-M1 through 10.1.43
Apache Tomcat versions 11.0.0-M1 through 11.0.9

Overview

A vulnerability has been reported in Apache Tomcat, which could allow an attacker to cause denial of service conditions on the target system.

Target Audience:
All end-user organisations and individuals responsible for maintaining and updating Apache Tomcat.

Risk Assessment:
High risk of service disruption and resource exhaustion.

Impact Assessment:
Potential for Denial of Service (DoS).

Description

Apache Tomcat is an open-source web server and servlet container that runs Java-based web applications.

This vulnerability exists in the HTTP/2 implementation of Apache Tomcat due to improper handling of malformed client requests, which can trigger server-side stream resets without updating abuse counters. An attacker could exploit this vulnerability to repeatedly send requests, resulting in resource exhaustion.

Successful exploitation of the vulnerability could allow the attacker to cause denial of service conditions on the target system.

The vulnerability is also termed the "MadeYouReset" attack.

Solution

Upgrade to latest Apache Tomcat version:
https://tomcat.apache.org/security-9.html

https://tomcat.apache.org/security-10.html

https://tomcat.apache.org/security-11.html

Vendor Information

Apache Tomcat
https://tomcat.apache.org/security-9.html
https://tomcat.apache.org/security-10.html
https://tomcat.apache.org/security-11.html

References

Apache Tomcat
https://tomcat.apache.org/security-9.html
https://tomcat.apache.org/security-10.html
https://tomcat.apache.org/security-11.html

CVE Name
CVE-2025-48989

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India