CVE-2025-61795: Apache Tomcat Improper Resource Shutdown Vulnerability
Summary
CVE-2025-61795: Apache Tomcat Vulnerable to Improper Resource Shutdown or Release. Affects org.apache.tomcat:tomcat across 4 version ranges.
>= 8.5.60, <= 8.5.100
>= 9.0.0.40, < 9.0.110
>= 10.1.0-M1, < 10.1.47
>= 11.0.0-M1, < 11.0.12
Fixed in 9.0.110, 10.1.47 or 11.0.12, depending on the release line you run. How to fix ↓
Also tracked for
- tomcat · Bitnami
The same CVE-2025-61795 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Tomcat is a widely used open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It serves as a web server and servlet container, enabling the deployment of Java applications. The affected versions of Tomcat are vulnerable to resource management issues, particularly during multipart uploads, which can lead to denial of service (DoS) conditions.
Vulnerability Detail
The vulnerability arises from improper handling of temporary files created during multipart uploads. When an error occurs, such as exceeding limits, these temporary files are not immediately deleted but are left for garbage collection. Depending on the Java Virtual Machine (JVM) settings and application load, this can lead to excessive memory usage, potentially causing the application to become unresponsive or crash due to resource exhaustion.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 9.0.0.40, < 9.0.1109.0.110 -
>= 10.1.0-M1, < 10.1.4710.1.47 -
>= 11.0.0-M1, < 11.0.1211.0.12
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can monitor their application's memory usage and implement custom cleanup routines for temporary files if feasible. However, upgrading to the patched version is strongly recommended for a permanent fix.
Conclusion
In summary, CVE-2025-61795 is a significant vulnerability in Apache Tomcat that can lead to denial of service due to improper resource management during multipart uploads. Users are strongly encouraged to upgrade to the latest patched versions to mitigate this risk.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
CVE-2025-61795 is a vulnerability in Apache Tomcat that allows for improper resource shutdown during multipart uploads, potentially leading to denial of service.
The vulnerability affects Apache Tomcat versions from 11.0.0-M1 through 11.0.11, 10.1.0-M1 through 10.1.46, and 9.0.0.M1 through 9.0.109.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By simply using your pom.xml, you can check if your application is affected by this vulnerability without requiring access to the code.
If an immediate upgrade is not possible, consider implementing monitoring for memory usage and custom cleanup routines for temporary files as a temporary workaround.
For more details, you can refer to the official advisory on GitHub or check the Vulert platform for real-time monitoring of vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
