Skip to content
OpenAdvisories
High · 7.5 CVE-2025-52434 BIT-tomcat-2025-52434EUVD-2025-21045GHSA-4j3c-42xv-3f84

Apache Tomcat: APR/Native Connector crash leading to DoS

Published Jul 10, 2025 · Updated Nov 4, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Tomcat Package: org.apache.tomcat:tomcat-coyote Package: org.apache.tomcat.embed:tomcat-embed-core Package: tomcat8 Package: tomcat9 Package: tomcat9 Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu

Description

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.

This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions
may also be affected.

Users are recommended to upgrade to version 9.0.107, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Tomcat 9.0.0.M1 – ≤ 9.0.106, 8.5.0 – ≤ 8.5.100 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 tomcat9 9.0.70-2 —
Debian 13 tomcat9 9.0.70-2 —
Debian 12 tomcat9 9.0.70-2 —
Debian 11 tomcat9 9.0.107-0+deb11u1 DLA-4244-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS tomcat9 No fix yet —
Ubuntu Pro 20.04 LTS tomcat9 No fix yet —
Ubuntu Pro 18.04 LTS tomcat8 +1 No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS tomcat8 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 tomcat9 +7 1:9.0.87-5.el10_0.3 RHSA-2025:14178
RHEL 9 tomcat +7 1:9.0.87-3.el9_6.3 RHSA-2025:14181
RHEL 8 tomcat +7 1:9.0.87-1.el8_10.6 RHSA-2025:14177
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.4 EUS tomcat +7 1:9.0.87-1.el9_4.6 RHSA-2025:14180
RHEL 9.2 E4S tomcat +7 1:9.0.87-1.el9_2.6 RHSA-2025:14183
RHEL 8.8 TUS tomcat +7 1:9.0.87-1.el8_8.7 RHSA-2025:14182
RHEL 8.8 E4S tomcat +7 1:9.0.87-1.el8_8.7 RHSA-2025:14182
Red Hat JBoss Web Server 5 jws5-tomcat +11 9.0.87-12.redhat_00011.1.el7jws RHSA-2025:11695

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 tomcat9 +7 1:9.0.87-5.el10_0.3 ALSA-2025:14178
AlmaLinux 9 tomcat +7 1:9.0.87-3.el9_6.3 ALSA-2025:14181
AlmaLinux 8 tomcat +7 1:9.0.87-1.el8_10.6 ALSA-2025:14177

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 tomcat9 1:9.0.87-5.el10_0.3 RLSA-2025:14178
Rocky Linux 9 tomcat 1:9.0.87-3.el9_6.3 RLSA-2025:14181
Rocky Linux 8 tomcat 1:9.0.87-1.el8_10.6 RLSA-2025:14177

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 tomcat 9.0.108-150200.91.1 SUSE-SU-2025:03024-1
SLES 15 SP6 tomcat 9.0.108-150200.91.1 SUSE-SU-2025:03024-1
SLES 15 SP5 tomcat 9.0.108-150200.91.1 SUSE-SU-2025:03024-1
SLES 15 SP4 tomcat 9.0.108-150200.91.1 SUSE-SU-2025:03024-1
SLES 15 SP3 tomcat 9.0.108-150200.91.1 SUSE-SU-2025:03024-1
Show 9 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP5 tomcat 9.0.115-3.160.1 SUSE-SU-2026:1058-1
SLES for SAP 15 SP5 tomcat 9.0.108-150200.91.1 SUSE-SU-2025:03024-1
SLES for SAP 15 SP4 tomcat 9.0.108-150200.91.1 SUSE-SU-2025:03024-1
SLES for SAP 15 SP3 tomcat 9.0.108-150200.91.1 SUSE-SU-2025:03024-1
SLE HPC 15 SP5 tomcat 9.0.108-150200.91.1 SUSE-SU-2025:03024-1
SLE HPC 15 SP4 tomcat 9.0.108-150200.91.1 SUSE-SU-2025:03024-1
SLE HPC 15 SP3 tomcat 9.0.108-150200.91.1 SUSE-SU-2025:03024-1
SUSE Manager Server LTS 4.3 tomcat 9.0.108-150200.91.1 SUSE-SU-2025:03024-1
SUSE Enterprise Storage 7.1 tomcat 9.0.108-150200.91.1 SUSE-SU-2025:03024-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed tomcat 9.0.107-1.1 openSUSE-SU-2025:15440-1
openSUSE Leap 15.6 tomcat 9.0.108-150200.91.1 SUSE-SU-2025:03024-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 tomcat9 +7 1:9.0.107-1.amzn2023.0.1 ALAS2023-2025-1094

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 tomcat9 +7 1:9.0.87-5.el10_0.3 ELSA-2025-14178
Oracle Linux 9 tomcat +7 1:9.0.87-3.el9_6.3 ELSA-2025-14181
Oracle Linux 8 tomcat +7 1:9.0.87-1.el8_10.6 ELSA-2025-14177

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.tomcat:tomcat-coyote >= 9.0.0.M1, < 9.0.107 9.0.107 GHSA-4j3c-42xv-3f84
Maven org.apache.tomcat:tomcat-coyote >= 8.5.0, <= 8.5.100 — GHSA-4j3c-42xv-3f84
Maven org.apache.tomcat.embed:tomcat-embed-core >= 9.0.0.M1, < 9.0.107 9.0.107 GHSA-4j3c-42xv-3f84
Maven org.apache.tomcat.embed:tomcat-embed-core >= 8.5.0, <= 8.5.100 — GHSA-4j3c-42xv-3f84

Advisories 26

References