Skip to content
OpenAdvisories
High ALAS2023-2025-1094 3 CVEs

Important: tomcat9 security update (Amazon Linux 2023)

Published Jul 21, 2025 · Updated Aug 8, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-53506: Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue. CVE-2025-52520: For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue. CVE-2025-52434: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections. This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106. Users are recommended to upgrade to version 9.0.107, which fixes the issue.

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2023 tomcat9 1:9.0.107-1.amzn2023.0.1
Amazon Linux · 2023 tomcat9-admin-webapps 1:9.0.107-1.amzn2023.0.1
Amazon Linux · 2023 tomcat9-docs-webapp 1:9.0.107-1.amzn2023.0.1
Amazon Linux · 2023 tomcat9-el-3.0-api 1:9.0.107-1.amzn2023.0.1
Amazon Linux · 2023 tomcat9-jsp-2.3-api 1:9.0.107-1.amzn2023.0.1
Amazon Linux · 2023 tomcat9-lib 1:9.0.107-1.amzn2023.0.1
Amazon Linux · 2023 tomcat9-servlet-4.0-api 1:9.0.107-1.amzn2023.0.1
Amazon Linux · 2023 tomcat9-webapps 1:9.0.107-1.amzn2023.0.1

Vulnerabilities 3

  • High 7.5
    CVE-2025-52434

    Apache Tomcat: APR/Native Connector crash leading to DoS

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections. This issue aff…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
  • High 7.5
    CVE-2025-52520

    Apache Tomcat: DoS via integer overflow in multipart file upload

    For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
  • High 7.5
    CVE-2025-53506

    Apache Tomcat: DoS via excessive h2 streams at connection start

    Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10…

    Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Wolfi Maven

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-52434.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-52520.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-53506.html