CVE-2025-53506: Apache Tomcat Coyote Denial of Service via Excessive HTTP/2 Streams
Summary
CVE-2025-53506: Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams. Affects org.apache.tomcat:tomcat-coyote across 4 version ranges.
>= 8.5.0, <= 8.5.100
>= 9.0.0.M1, < 9.0.107
>= 10.1.0-M1, < 10.1.43
>= 11.0.0-M1, < 11.0.9
Fixed in 9.0.107, 10.1.43 or 11.0.9, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2025-53506 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java web applications. The Tomcat Coyote component is responsible for handling HTTP requests and responses. This vulnerability affects specific versions of Tomcat Coyote, making it susceptible to resource exhaustion attacks when HTTP/2 clients do not acknowledge initial settings frames.
Vulnerability Detail
The vulnerability arises from uncontrolled resource consumption in Apache Tomcat Coyote when an HTTP/2 client fails to acknowledge the initial settings frame that limits the maximum number of concurrent streams. This can lead to Denial of Service (DoS) as the server may become overwhelmed with excessive streams, causing it to become unresponsive. The affected versions include Apache Tomcat from 11.0.0-M1 to 11.0.8, 10.1.0-M1 to 10.1.42, and 9.0.0.M1 to 9.0.106.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 9.0.0.M1, < 9.0.1079.0.107 -
>= 10.1.0-M1, < 10.1.4310.1.43 -
>= 11.0.0-M1, < 11.0.911.0.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can limit the number of concurrent streams allowed by configuring the HTTP/2 settings in their server configuration. However, this is not a permanent solution and upgrading to the patched version is strongly recommended.
Conclusion
In summary, CVE-2025-53506 is a significant vulnerability in Apache Tomcat Coyote that can lead to Denial of Service due to excessive HTTP/2 streams. Users are urged to upgrade to the latest patched versions to mitigate this risk. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for org.apache.tomcat:tomcat-coyote →
FAQ
CVE-2025-53506 is a vulnerability in Apache Tomcat Coyote that allows for Denial of Service due to uncontrolled resource consumption when HTTP/2 clients do not acknowledge initial settings frames.
The affected versions are Apache Tomcat from 11.0.0-M1 to 11.0.8, 10.1.0-M1 to 10.1.42, and 9.0.0.M1 to 9.0.106.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner without any signup.
The CVSS score for this vulnerability is 7.5, indicating a moderate severity level.
If you cannot upgrade immediately, consider implementing temporary workarounds such as limiting the number of concurrent streams in your server configuration.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat-coyote.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
