CVE-2025-52520: Apache Tomcat Catalina Integer Overflow Vulnerability Leading to DoS
Summary
CVE-2025-52520: Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits. Affects org.apache.tomcat:tomcat-catalina across 4 version ranges.
>= 8.5.0, <= 8.5.100
>= 9.0.0.M1, < 9.0.107
>= 10.1.0-M1, < 10.1.43
>= 11.0.0-M1, < 11.0.9
Fixed in 9.0.107, 10.1.43 or 11.0.9, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2025-52520 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java applications and provides a robust environment for running web applications. The Tomcat Catalina component is responsible for managing the servlet lifecycle and handling requests. However, certain configurations of multipart uploads in Tomcat can expose it to vulnerabilities, such as integer overflow, which can lead to denial of service (DoS) attacks.
Vulnerability Detail
The vulnerability arises from an integer overflow in the Apache Tomcat Catalina component, which can occur under specific and unlikely configurations of multipart uploads. This flaw allows attackers to bypass size limits, potentially leading to a denial of service (DoS) condition. The vulnerability affects multiple versions of Tomcat, specifically from 11.0.0-M1 to 11.0.8, from 10.1.0-M1 to 10.1.42, and from 9.0.0.M1 to 9.0.106. The severity of this vulnerability is rated as moderate, with a CVSS score of 7.5.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 9.0.0.M1, < 9.0.1079.0.107 -
>= 10.1.0-M1, < 10.1.4310.1.43 -
>= 11.0.0-M1, < 11.0.911.0.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can implement additional validation checks on multipart uploads to ensure that size limits are enforced correctly, although upgrading to the patched versions is the most effective solution.
Conclusion
The CVE-2025-52520 vulnerability in Apache Tomcat Catalina poses a risk of denial of service due to integer overflow in multipart uploads. Users are strongly advised to upgrade to the latest patched versions to mitigate this risk. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in your applications.
See every vulnerability recorded for org.apache.tomcat:tomcat-catalina →
FAQ
CVE-2025-52520 is a vulnerability in Apache Tomcat Catalina that can lead to a denial of service (DoS) attack due to an integer overflow in multipart upload handling.
The affected versions include Apache Tomcat 11.0.0-M1 to 11.0.8, 10.1.0-M1 to 10.1.42, and 9.0.0.M1 to 9.0.106.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the pom.xml file. Visit the Vulert playground at Vulert Scanner to check your application without any signup.
If immediate upgrading is not possible, consider implementing additional validation checks on multipart uploads as a temporary workaround.
The CVSS score for CVE-2025-52520 is 7.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat-catalina.
