p PatchFirst

CVE-2025-48988

CVE-2025-48988 · Apache Tomcat: FileUpload large number of parts with headers DoS

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

CVSS 7.5 · High · EPSS 30.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • apache tomcat

    Versions
    • ≥ 11.0.0-M1, ≤ 11.0.7: Affected (semver)
    • ≥ 10.1.0-M1, ≤ 10.1.41: Affected (semver)
    • ≥ 9.0.0.M1, ≤ 9.0.105: Affected (semver)
    • ≥ 8.5.0, ≤ 8.5.100: Affected (semver)
    • ≥ 6, < 8.5.0: Unknown (semver)
    • ≥ 10.0.0-M1, ≤ 10.0.27: Unknown (semver)

    No fix published

  • tomcat10 Debian:12

    Versions
    • 10.1.10-1
    • 10.1.13-1
    • 10.1.14-1
    • 10.1.15-1
    • 10.1.16-1
    • 10.1.20-1
    • 10.1.23-1
    • 10.1.25-1
    • 10.1.25-1~bpo12+1
    • 10.1.25-2
    • 10.1.30-1
    • 10.1.30-1~bpo12+1
    • 10.1.31-1
    • 10.1.33-1
    • 10.1.33-1~bpo12+1
    • 10.1.34-0+deb12u1
    • 10.1.34-0+deb12u2
    • 10.1.34-1
    • 10.1.35-1
    • 10.1.40-1
    • 10.1.40-1~bpo12+1
    • 10.1.46-1
    • 10.1.6-1
    • 10.1.6-1+deb12u1
    • 10.1.6-1+deb12u2
    • 10.1.7-1
    • 10.1.8-1
    • 10.1.9-1
    Affected ranges
    • ECOSYSTEM: < 10.1.52-1~deb12u1

    Update to 10.1.52-1~deb12u1

  • tomcat10 Debian:13

    Versions
    • 10.1.40-1
    • 10.1.46-1
    • 10.1.52-1~deb12u1
    Affected ranges
    • ECOSYSTEM: < 10.1.52-1~deb13u1

    Update to 10.1.52-1~deb13u1

  • tomcat10 Debian:14

    Versions
    • 10.1.40-1
    Affected ranges
    • ECOSYSTEM: < 10.1.46-1

    Update to 10.1.46-1

  • tomcat11 Debian:13

    Versions
    • 11.0.11-1
    • 11.0.6-1
    Affected ranges
    • ECOSYSTEM: < 11.0.15-1~deb13u1

    Update to 11.0.15-1~deb13u1

  • tomcat11 Debian:14

    Versions
    • 11.0.6-1
    Affected ranges
    • ECOSYSTEM: < 11.0.11-1

    Update to 11.0.11-1

  • tomcat9 Debian:12

    Affected ranges
    • ECOSYSTEM: < 9.0.70-2

    Update to 9.0.70-2

  • tomcat9 Debian:13

    Affected ranges
    • ECOSYSTEM: < 9.0.70-2

    Update to 9.0.70-2

  • tomcat9 Debian:14

    Affected ranges
    • ECOSYSTEM: < 9.0.70-2

    Update to 9.0.70-2

  • tomcat6 Ubuntu:Pro:14.04:LTS

    Versions
    • 6.0.37-1
    • 6.0.39-1
    • 6.0.39-1ubuntu0.1
    • 6.0.39-1ubuntu0.1+esm1
    • 6.0.39-1ubuntu0.1+esm2
    • 6.0.39-1ubuntu0.1+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat7 Ubuntu:Pro:14.04:LTS

    Versions
    • 7.0.42-1
    • 7.0.47-1
    • 7.0.50-1
    • 7.0.52-1
    • 7.0.52-1ubuntu0.1
    • 7.0.52-1ubuntu0.3
    • 7.0.52-1ubuntu0.6
    • 7.0.52-1ubuntu0.7
    • 7.0.52-1ubuntu0.8
    • 7.0.52-1ubuntu0.9
    • 7.0.52-1ubuntu0.10
    • 7.0.52-1ubuntu0.11
    • 7.0.52-1ubuntu0.13
    • 7.0.52-1ubuntu0.14
    • 7.0.52-1ubuntu0.15
    • 7.0.52-1ubuntu0.16
    • 7.0.52-1ubuntu0.16+esm1
    • 7.0.52-1ubuntu0.16+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat8 Ubuntu:Pro:16.04:LTS

    Versions
    • 8.0.26-1
    • 8.0.28-1
    • 8.0.30-1
    • 8.0.32-1
    • 8.0.32-1ubuntu1
    • 8.0.32-1ubuntu1.1
    • 8.0.32-1ubuntu1.2
    • 8.0.32-1ubuntu1.3
    • 8.0.32-1ubuntu1.4
    • 8.0.32-1ubuntu1.5
    • 8.0.32-1ubuntu1.6
    • 8.0.32-1ubuntu1.7
    • 8.0.32-1ubuntu1.8
    • 8.0.32-1ubuntu1.9
    • 8.0.32-1ubuntu1.10
    • 8.0.32-1ubuntu1.11
    • 8.0.32-1ubuntu1.13
    • 8.0.32-1ubuntu1.13+esm1
    • 8.0.32-1ubuntu1.13+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat7 Ubuntu:Pro:16.04:LTS

    Versions
    • 7.0.64-1
    • 7.0.68-1
    • 7.0.68-1ubuntu0.1
    • 7.0.68-1ubuntu0.3
    • 7.0.68-1ubuntu0.4
    • 7.0.68-1ubuntu0.4+esm1
    • 7.0.68-1ubuntu0.4+esm2
    • 7.0.68-1ubuntu0.4+esm3
    • 7.0.68-1ubuntu0.4+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat8 Ubuntu:Pro:18.04:LTS

    Versions
    • 8.5.21-1ubuntu1
    • 8.5.29-1
    • 8.5.30-1
    • 8.5.30-1ubuntu1
    • 8.5.30-1ubuntu1.2
    • 8.5.30-1ubuntu1.3
    • 8.5.30-1ubuntu1.4
    • 8.5.39-1ubuntu1~18.04.1
    • 8.5.39-1ubuntu1~18.04.2
    • 8.5.39-1ubuntu1~18.04.3
    • 8.5.39-1ubuntu1~18.04.3+esm1
    • 8.5.39-1ubuntu1~18.04.3+esm2
    • 8.5.39-1ubuntu1~18.04.3+esm3
    • 8.5.39-1ubuntu1~18.04.3+esm4
    • 8.5.39-1ubuntu1~18.04.3+esm5
    • 8.5.39-1ubuntu1~18.04.3+esm6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat9 Ubuntu:Pro:18.04:LTS

    Versions
    • 9.0.16-3~18.04.1
    • 9.0.16-3ubuntu0.18.04.1
    • 9.0.16-3ubuntu0.18.04.2
    • 9.0.16-3ubuntu0.18.04.2+esm1
    • 9.0.16-3ubuntu0.18.04.2+esm2
    • 9.0.16-3ubuntu0.18.04.2+esm3
    • 9.0.16-3ubuntu0.18.04.2+esm4
    • 9.0.16-3ubuntu0.18.04.2+esm5
    • 9.0.16-3ubuntu0.18.04.2+esm6
    • 9.0.16-3ubuntu0.18.04.2+esm7
    • 9.0.16-3ubuntu0.18.04.2+esm8
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat9 Ubuntu:Pro:20.04:LTS

    Versions
    • 9.0.24-1
    • 9.0.27-1
    • 9.0.31-1
    • 9.0.31-1ubuntu0.1
    • 9.0.31-1ubuntu0.2
    • 9.0.31-1ubuntu0.3
    • 9.0.31-1ubuntu0.4
    • 9.0.31-1ubuntu0.5
    • 9.0.31-1ubuntu0.6
    • 9.0.31-1ubuntu0.7
    • 9.0.31-1ubuntu0.8
    • 9.0.31-1ubuntu0.9
    • 9.0.31-1ubuntu0.9+esm1
    • 9.0.31-1ubuntu0.9+esm2
    • 9.0.31-1ubuntu0.9+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat9 Ubuntu:Pro:22.04:LTS

    Versions
    • 9.0.43-3
    • 9.0.54-1
    • 9.0.55-1
    • 9.0.58-1
    • 9.0.58-1ubuntu0.1
    • 9.0.58-1ubuntu0.1+esm1
    • 9.0.58-1ubuntu0.1+esm2
    • 9.0.58-1ubuntu0.1+esm3
    • 9.0.58-1ubuntu0.1+esm4
    • 9.0.58-1ubuntu0.2
    • 9.0.58-1ubuntu0.2+esm1
    • 9.0.58-1ubuntu0.2+esm2
    • 9.0.58-1ubuntu0.2+esm3
    • 9.0.58-1ubuntu0.2+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat10 Ubuntu:24.04:LTS

    Versions
    • 10.1.10-1
    • 10.1.14-1
    • 10.1.15-1
    • 10.1.16-1
    • 10.1.16-1ubuntu0.1~esm1
    • 10.1.16-1ubuntu0.1~esm2
    • 10.1.16-1ubuntu0.1~esm3
    • 10.1.16-1ubuntu0.1~esm4
    • 10.1.55-1ubuntu2~24.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat10 Ubuntu:25.10

    Versions
    • 10.1.35-1
    • 10.1.40-1
    • 10.1.40-1ubuntu1
    • 10.1.40-1ubuntu1.25.10.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat11 Ubuntu:25.10

    Versions
    • 11.0.6-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat10 Ubuntu:26.10

    Versions
    • 10.1.40-1ubuntu1
    • 10.1.54-1
    • 10.1.54-1ubuntu1
    • 10.1.54-1ubuntu2
    • 10.1.55-1ubuntu1
    • 10.1.55-1ubuntu2
    • 10.1.57~us1-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat10 Ubuntu:26.04:LTS

    Versions
    • 10.1.40-1ubuntu1
    • 10.1.40-1ubuntu1.26.04.1
    • 10.1.55-1ubuntu2~26.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat11 Ubuntu:26.04:LTS

    Versions
    • 11.0.6-1
    • 11.0.11-1
    • 11.0.15-1
    • 11.0.18-1
    • 11.0.18-1ubuntu0.1~esm1
    • 11.0.22-2ubuntu2~26.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →