~ / search / GHSA-4j3c-42xv-3f84

GHSA-4j3c-42xv-3f84

Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-52434

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.tomcat:tomcat-coyote >= 9.0.0.M1, < 9.0.107 9.0.107
Maven org.apache.tomcat:tomcat-coyote >= 8.5.0, <= 8.5.100 no fix listed
Maven org.apache.tomcat.embed:tomcat-embed-core >= 9.0.0.M1, < 9.0.107 9.0.107
Maven org.apache.tomcat.embed:tomcat-embed-core >= 8.5.0, <= 8.5.100 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections. This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 9.0.107, which fixes the issue.

References

External links from the advisory. They lead to third-party sites.