Skip to content
OpenAdvisories
High · 7.5 Public exploit CVE-2025-48988 BIT-tomcat-2025-48988EUVD-2025-18409GHSA-h3gc-qfqq-6h8f

Apache Tomcat: FileUpload large number of parts with headers DoS

Published Jun 16, 2025 · Updated Nov 3, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Tomcat Package: org.apache.tomcat:tomcat-catalina Package: org.apache.tomcat.embed:tomcat-embed-core Package: thingsboard Package: thingsboard-tb-js-executor Package: thingsboard-tb-mqtt-transport Package: thingsboard-tb-node Package: thingsboard-tb-web-ui Package: tomcat10 Package: tomcat10 Package: tomcat11 Package: tomcat11 Package: tomcat6 Package: tomcat7 Package: tomcat8 Package: tomcat9 Package: tomcat9 Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions
may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Tomcat 11.0.0-M1 – ≤ 11.0.7, 10.1.0-M1 – ≤ 10.1.41, 9.0.0.M1 – ≤ 9.0.105, 8.5.0 – ≤ 8.5.100 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 tomcat10 10.1.46-1 —
Debian 14 tomcat11 11.0.11-1 —
Debian 14 tomcat9 9.0.70-2 —
Debian 13 tomcat10 10.1.52-1~deb13u1 DSA-6120-1
Debian 13 tomcat11 11.0.15-1~deb13u1 DSA-6121-1
Debian 13 tomcat9 9.0.70-2 —
Debian 12 tomcat10 10.1.52-1~deb12u1 DSA-6120-1
Debian 12 tomcat9 9.0.70-2 —
Debian 11 tomcat9 9.0.107-0+deb11u1 DLA-4244-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 tomcat10 No fix yet —
Ubuntu 26.04 LTS tomcat10 No fix yet —
Ubuntu 25.10 tomcat10 +1 No fix yet —
Ubuntu 24.04 LTS tomcat10 No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS tomcat9 No fix yet —
Ubuntu Pro 20.04 LTS tomcat9 No fix yet —
Ubuntu Pro 18.04 LTS tomcat8 +1 No fix yet —
Ubuntu Pro 16.04 LTS tomcat7 +1 No fix yet —
Ubuntu Pro 14.04 LTS tomcat6 +1 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 tomcat +7 1:10.1.36-1.el10_0.2 RHSA-2025:14179
RHEL 10 tomcat9 +7 1:9.0.87-5.el10_0.3 RHSA-2025:14178
RHEL 9 tomcat +7 1:9.0.87-3.el9_6.3 RHSA-2025:14181
RHEL 8 tomcat +7 1:9.0.87-1.el8_10.6 RHSA-2025:14177
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.4 EUS tomcat +7 1:9.0.87-1.el9_4.6 RHSA-2025:14180
RHEL 9.2 E4S tomcat +7 1:9.0.87-1.el9_2.6 RHSA-2025:14183
RHEL 8.8 TUS tomcat +7 1:9.0.87-1.el8_8.7 RHSA-2025:14182
RHEL 8.8 E4S tomcat +7 1:9.0.87-1.el8_8.7 RHSA-2025:14182
Red Hat JBoss Web Server 6 jws6-tomcat +9 10.1.36-7.redhat_00008.1.el8jws RHSA-2025:11741
Red Hat JBoss Web Server 5 jws5-tomcat +11 9.0.87-12.redhat_00011.1.el7jws RHSA-2025:11695

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 tomcat9 +7 1:9.0.87-5.el10_0.3 ALSA-2025:14178
AlmaLinux 9 tomcat +7 1:9.0.87-3.el9_6.3 ALSA-2025:14181
AlmaLinux 8 tomcat +7 1:9.0.87-1.el8_10.6 ALSA-2025:14177

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 tomcat 1:10.1.36-1.el10_0.2 RLSA-2025:14179
Rocky Linux 10 tomcat9 1:9.0.87-5.el10_0.3 RLSA-2025:14178
Rocky Linux 9 tomcat 1:9.0.87-3.el9_6.3 RLSA-2025:14181
Rocky Linux 8 tomcat 1:9.0.87-1.el8_10.6 RLSA-2025:14177

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 tomcat 9.0.106-150200.86.1 SUSE-SU-2025:02280-1
SLES 15 SP7 tomcat10 10.1.42-150200.5.45.1 SUSE-SU-2025:02261-1
SLES 15 SP6 tomcat 9.0.106-150200.86.1 SUSE-SU-2025:02280-1
SLES 15 SP6 tomcat10 10.1.42-150200.5.45.1 SUSE-SU-2025:02261-1
SLES 15 SP5 tomcat 9.0.106-150200.86.1 SUSE-SU-2025:02280-1
SLES 15 SP5 tomcat10 10.1.42-150200.5.45.1 SUSE-SU-2025:02261-1
SLES 15 SP4 tomcat 9.0.106-150200.86.1 SUSE-SU-2025:02280-1
SLES 15 SP3 tomcat 9.0.106-150200.86.1 SUSE-SU-2025:02280-1
Show 9 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP5 tomcat 9.0.36-3.145.1 SUSE-SU-2026:1058-1, SUSE-SU-2025:02214-1
SLES for SAP 15 SP5 tomcat 9.0.106-150200.86.1 SUSE-SU-2025:02280-1
SLES for SAP 15 SP5 tomcat10 10.1.42-150200.5.45.1 SUSE-SU-2025:02261-1
SLES for SAP 15 SP4 tomcat 9.0.106-150200.86.1 SUSE-SU-2025:02280-1
SLES for SAP 15 SP3 tomcat 9.0.106-150200.86.1 SUSE-SU-2025:02280-1
SLE HPC 15 SP5 tomcat 9.0.106-150200.86.1 SUSE-SU-2025:02280-1
SLE HPC 15 SP5 tomcat10 10.1.42-150200.5.45.1 SUSE-SU-2025:02261-1
SLE HPC 15 SP4 tomcat 9.0.106-150200.86.1 SUSE-SU-2025:02280-1
SLE HPC 15 SP3 tomcat 9.0.106-150200.86.1 SUSE-SU-2025:02280-1
SUSE Manager Server 4.3 tomcat 9.0.106-150200.86.1 SUSE-SU-2025:02280-1
SUSE Enterprise Storage 7.1 tomcat 9.0.106-150200.86.1 SUSE-SU-2025:02280-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed tomcat 9.0.106-1.1 openSUSE-SU-2025:15301-1
openSUSE Tumbleweed tomcat10 10.1.42-1.1 openSUSE-SU-2025:15302-1
openSUSE Tumbleweed tomcat11 11.0.8-1.1 openSUSE-SU-2025:15303-1
openSUSE Leap 15.6 tomcat 9.0.106-150200.86.1 SUSE-SU-2025:02280-1
openSUSE Leap 15.6 tomcat10 10.1.42-150200.5.45.1 SUSE-SU-2025:02261-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 tomcat10 +7 1:10.1.42-1.amzn2023.0.1 ALAS2023-2025-1064
Amazon Linux 2023 tomcat9 +7 1:9.0.106-1.amzn2023.0.1 ALAS2023-2025-1065
Amazon Linux 2 tomcat +9 7.0.76-10.amzn2.0.13 ALAS2-2025-2919

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 tomcat +7 1:10.1.36-1.el10_0.2 ELSA-2025-14179
Oracle Linux 10 tomcat9 +7 1:9.0.87-5.el10_0.3 ELSA-2025-14178
Oracle Linux 9 tomcat +7 1:9.0.87-3.el9_6.3 ELSA-2025-14181
Oracle Linux 8 tomcat +7 1:9.0.87-1.el8_10.6 ELSA-2025-14177

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling thingsboard +4 4.0.1-r8 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.tomcat:tomcat-catalina >= 11.0.0-M1, < 11.0.8 11.0.8 GHSA-h3gc-qfqq-6h8f
Maven org.apache.tomcat:tomcat-catalina >= 10.1.0-M1, < 10.1.42 10.1.42 GHSA-h3gc-qfqq-6h8f
Maven org.apache.tomcat:tomcat-catalina >= 9.0.0.M1, < 9.0.106 9.0.106 GHSA-h3gc-qfqq-6h8f
Maven org.apache.tomcat:tomcat-catalina >= 8.5.0, <= 8.5.100 — GHSA-h3gc-qfqq-6h8f
Maven org.apache.tomcat.embed:tomcat-embed-core >= 11.0.0-M1, < 11.0.8 11.0.8 GHSA-h3gc-qfqq-6h8f
Maven org.apache.tomcat.embed:tomcat-embed-core >= 10.1.0-M1, < 10.1.42 10.1.42 GHSA-h3gc-qfqq-6h8f
Maven org.apache.tomcat.embed:tomcat-embed-core >= 9.0.0.M1, < 9.0.106 9.0.106 GHSA-h3gc-qfqq-6h8f
Maven org.apache.tomcat.embed:tomcat-embed-core >= 8.5.0, <= 8.5.100 — GHSA-h3gc-qfqq-6h8f

Advisories 41

References