Description
Improper Resource Shutdown or Release vulnerability in Apache Tomcat.
If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Tomcat | 11.0.0-M1 – ≤ 11.0.11, 10.1.0-M1 – ≤ 10.1.46, 9.0.0.M1 – ≤ 9.0.109, 8.5.0 – ≤ 8.5.100 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tomcat10 | 10.1.52-1 | — |
| Debian 14 | tomcat11 | 11.0.15-1 | — |
| Debian 14 | tomcat9 | 9.0.70-2 | — |
| Debian 13 | tomcat10 | 10.1.52-1~deb13u1 | DSA-6120-1 |
| Debian 13 | tomcat11 | 11.0.15-1~deb13u1 | DSA-6121-1 |
| Debian 13 | tomcat9 | 9.0.70-2 | — |
| Debian 12 | tomcat10 | 10.1.52-1~deb12u1 | DSA-6120-1 |
| Debian 12 | tomcat9 | 9.0.70-2 | — |
| Debian 11 | tomcat9 | 9.0.107-0+deb11u2 | DLA-4468-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | tomcat10 | No fix yet | — |
| Ubuntu 25.10 | tomcat10 +1 | No fix yet | — |
| Ubuntu 24.04 LTS | tomcat10 | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | tomcat9 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | tomcat9 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | tomcat8 +1 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | tomcat7 +1 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | tomcat6 +1 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | tomcat +7 | 1:10.1.36-3.el10_1.1 | RHSA-2025:23050 |
| RHEL 10 | tomcat9 +7 | 1:9.0.110-2.el10_2 | RHSA-2026:18536 |
| RHEL 9 | tomcat +7 | 1:9.0.110-2.el9_8 | RHSA-2026:18916 |
| RHEL 8 | tomcat +7 | 1:9.0.120-1.el8_10 | RHSA-2026:68677 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | tomcat +7 | 1:10.1.36-1.el10_0.3 | RHSA-2025:23051 |
| RHEL 10.0 EUS | tomcat9 +7 | 1:9.0.120-1.el10_0 | RHSA-2026:67163 |
| RHEL 9.6 EUS | tomcat +7 | 1:9.0.120-1.el9_6 | RHSA-2026:68659 |
| RHEL 9.4 E4S | tomcat +7 | 1:9.0.120-1.el9_4 | RHSA-2026:68679 |
| RHEL 9.2 E4S | tomcat +7 | 1:9.0.120-1.el9_2 | RHSA-2026:68678 |
| RHEL 8.8 TUS | tomcat +7 | 1:9.0.120-1.el8_8 | RHSA-2026:68680 |
| RHEL 8.8 E4S | tomcat +7 | 1:9.0.120-1.el8_8 | RHSA-2026:68680 |
| Red Hat JBoss Web Server 6 | jws6-tomcat +9 | 10.1.36-19.redhat_00018.1.el8jws | RHSA-2025:19809 |
| Red Hat Hardened Images 1 | tomcat10 +9 | 10.1.54-1.hum1 | RHSA-2026:8334 |
| Red Hat Hardened Images 1 | tomcat11 +7 | 11.0.21-0.1.hum1 | RHSA-2026:6569 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | tomcat +7 | 1:10.1.36-3.el10_1.1 | ALSA-2025:23050 |
| AlmaLinux 8 | tomcat +7 | 1:9.0.120-1.el8_10 | ALSA-2026:68677 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | tomcat | 1:10.1.36-3.el10_1.1 | RLSA-2025:23050 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | tomcat | 9.0.111-150200.96.1 | SUSE-SU-2025:4159-1 |
| SLES 15 SP7 | tomcat10 | 10.1.48-150200.5.54.1 | SUSE-SU-2025:4103-1 |
| SLES 15 SP7 | tomcat11 | 11.0.13-150600.13.12.1 | SUSE-SU-2025:4086-1 |
| SLES 15 SP6 | tomcat | 9.0.111-150200.96.1 | SUSE-SU-2025:4159-1 |
| SLES 15 SP6 | tomcat10 | 10.1.48-150200.5.54.1 | SUSE-SU-2025:4103-1 |
| SLES 15 SP6 | tomcat11 | 11.0.13-150600.13.12.1 | SUSE-SU-2025:4086-1 |
| SLES 15 SP5 | tomcat | 9.0.111-150200.96.1 | SUSE-SU-2025:4159-1 |
| SLES 15 SP5 | tomcat10 | 10.1.48-150200.5.54.1 | SUSE-SU-2025:4103-1 |
| SLES 15 SP4 | tomcat | 9.0.111-150200.96.1 | SUSE-SU-2025:4159-1 |
| SLES 15 SP3 | tomcat | 9.0.111-150200.96.1 | SUSE-SU-2025:4159-1 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | tomcat | 9.0.36-3.153.2 | SUSE-SU-2026:1058-1, SUSE-SU-2025:4184-1 |
| SLES for SAP 16.0 | tomcat | 9.0.111-160000.1.1 | SUSE-SU-2026:20084-1 |
| SLES for SAP 16.0 | tomcat10 | 10.1.52-160000.1.1 | SUSE-SU-2026:20982-1 |
| SLES for SAP 16.0 | tomcat11 | 11.0.13-160000.1.1 | SUSE-SU-2025:21152-1 |
| SLES for SAP 15 SP5 | tomcat | 9.0.111-150200.96.1 | SUSE-SU-2025:4159-1 |
| SLES for SAP 15 SP5 | tomcat10 | 10.1.48-150200.5.54.1 | SUSE-SU-2025:4103-1 |
| SLES for SAP 15 SP4 | tomcat | 9.0.111-150200.96.1 | SUSE-SU-2025:4159-1 |
| SLES for SAP 15 SP3 | tomcat | 9.0.111-150200.96.1 | SUSE-SU-2025:4159-1 |
| SLES 16.0 | tomcat | 9.0.111-160000.1.1 | SUSE-SU-2026:20084-1 |
| SLES 16.0 | tomcat10 | 10.1.52-160000.1.1 | SUSE-SU-2026:20982-1 |
| SLES 16.0 | tomcat11 | 11.0.13-160000.1.1 | SUSE-SU-2025:21152-1 |
| SLE HPC 15 SP5 | tomcat | 9.0.111-150200.96.1 | SUSE-SU-2025:4159-1 |
| SLE HPC 15 SP5 | tomcat10 | 10.1.48-150200.5.54.1 | SUSE-SU-2025:4103-1 |
| SLE HPC 15 SP4 | tomcat | 9.0.111-150200.96.1 | SUSE-SU-2025:4159-1 |
| SLE HPC 15 SP3 | tomcat | 9.0.111-150200.96.1 | SUSE-SU-2025:4159-1 |
| SUSE Manager Server LTS 4.3 | tomcat | 9.0.111-150200.96.1 | SUSE-SU-2025:4159-1 |
| SUSE Enterprise Storage 7.1 | tomcat | 9.0.111-150200.96.1 | SUSE-SU-2025:4159-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | tomcat | 9.0.111-1.1 | openSUSE-SU-2025:15716-1 |
| openSUSE Tumbleweed | tomcat10 | 10.1.48-1.1 | openSUSE-SU-2025:15717-1 |
| openSUSE Tumbleweed | tomcat11 | 11.0.13-1.1 | openSUSE-SU-2025:15718-1 |
| openSUSE Leap 16.0 | tomcat | 9.0.111-160000.1.1 | openSUSE-SU-2026:20034-1 |
| openSUSE Leap 16.0 | tomcat10 | 10.1.52-160000.1.1 | openSUSE-SU-2026:20444-1 |
| openSUSE Leap 16.0 | tomcat11 | 11.0.13-160000.1.1 | openSUSE-SU-2025:20106-1 |
| openSUSE Leap 15.6 | tomcat | 9.0.111-150200.96.1 | SUSE-SU-2025:4159-1 |
| openSUSE Leap 15.6 | tomcat10 | 10.1.48-150200.5.54.1 | SUSE-SU-2025:4103-1 |
| openSUSE Leap 15.6 | tomcat11 | 11.0.13-150600.13.12.1 | SUSE-SU-2025:4086-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | tomcat10 +7 | 1:10.1.48-1.amzn2023.0.1 | ALAS2023-2025-1280 |
| Amazon Linux 2023 | tomcat9 +7 | 1:9.0.111-1.amzn2023.0.1 | ALAS2023-2025-1281 |
| Amazon Linux 2 | tomcat +9 | 7.0.76-10.amzn2.0.15 | ALAS2-2025-3067 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | tomcat +7 | 1:10.1.36-3.el10_1.1 | ELSA-2025-23050 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | thingsboard +4 | 4.2.1-r7 | — |
Affected packages
Advisories 50
- ALSA-2025:23050 Important: tomcat security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:68677 Important: tomcat security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:68680 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:68678 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:68679 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:68677 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:68659 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:67163 Red Hat Security Advisory: tomcat9 security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:6569 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:8334 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- RHSA-2026:18916 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:18536 Red Hat Security Advisory: tomcat9 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:23051 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:23050 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:19809 Red Hat Security Advisory: Red Hat JBoss Web Server 6.1.3 release and security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- WID-SEC-2025-2420 Apache Tomcat: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026
- ICSA-26-134-10 Siemens SIMATIC CISA ICS & IT advisories · May 14, 2026
- NCSC-2026-0147 Kwetsbaarheden verholpen in Siemens-producten NCSC-NL (Netherlands) · May 13, 2026
- SSA-032379 SSA-032379: Multiple Vulnerabilities in SIMATIC CN 4100 Before V5.0 Siemens ProductCERT · May 12, 2026
- WID-SEC-2026-0778 Dell Secure Connect Gateway Policy Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 11, 2026
- WID-SEC-2026-1194 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- SUSE-SU-2026:20982-1 Security update for tomcat10 SUSE / openSUSE Security Updates · Apr 10, 2026
- openSUSE-SU-2026:20444-1 Security update for tomcat10 SUSE / openSUSE Security Updates · Apr 3, 2026
- SUSE-SU-2026:1058-1 Security update for tomcat SUSE / openSUSE Security Updates · Mar 27, 2026
- openSUSE-SU-2026:20034-1 Security update for tomcat SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:20106-1 Security update for tomcat11 SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15717-1 tomcat10-10.1.48-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15718-1 tomcat11-11.0.13-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15716-1 tomcat-9.0.111-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20084-1 Security update for tomcat SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4103-1 Security update for tomcat10 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:21152-1 Security update for tomcat11 SUSE / openSUSE Security Updates · Mar 23, 2026
- DSA-6120-1 tomcat10 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-6121-1 tomcat11 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-4468-1 tomcat9 - security update Debian Security (DSA / DLA) · Feb 5, 2026
- SUSE-SU-2025:4184-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:4159-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- PPSA-2026-001 Pilz: Multiple Vulnerabilities affecting the PIT User Authentication Service CERT@VDE · Feb 2, 2026
- NCSC-2026-0025 Kwetsbaarheden verholpen in Oracle Financial Services NCSC-NL (Netherlands) · Jan 21, 2026
- NCSC-2026-0022 Kwetsbaarheden verholpen in Oracle Communications producten NCSC-NL (Netherlands) · Jan 21, 2026
- NCSC-2026-0021 Kwetsbaarheden verholpen in Oracle Database Server producten NCSC-NL (Netherlands) · Jan 21, 2026
- NCSC-2026-0020 Kwetsbaarheden verholpen in Oracle Commerce NCSC-NL (Netherlands) · Jan 21, 2026
- WID-SEC-2026-0166 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2026-0163 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2026-0154 Oracle Commerce: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2026-0153 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- RLSA-2025:23050 Important: tomcat security update Rocky Linux Security Advisories · Dec 12, 2025
- ELSA-2025-23050 Important: tomcat security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Dec 10, 2025
- SUSE-SU-2025:4086-1 Security update for tomcat11 SUSE / openSUSE Security Updates · Nov 13, 2025
- ALAS2-2025-3067 Moderate: tomcat security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 10, 2025
References
- https://lists.apache.org/thread/wm9mx8brmx9g4zpywm06ryrtvd3160pp vendor-advisory