Critical Security Update for Apache Tomcat: Addressing Multiple Denial of Service Vulnerabilities
Summary
ALSA-2025:14181: Important: tomcat security update. Affects tomcat versions < 1:9.0.87-3.el9_6.3. Fixed in 1:9.0.87-3.el9_6.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is a widely-used open-source servlet container that implements the Java Servlet and JavaServer Pages (JSP) technologies. It serves as a platform for running Java applications and is known for its robustness, scalability, and support for various Java EE specifications. However, like any software, it is susceptible to vulnerabilities that can compromise its security and availability. The recent vulnerabilities identified in Tomcat highlight critical issues that could lead to denial of service (DoS) attacks, affecting the stability and performance of applications running on this platform.
Vulnerability Detail
The vulnerabilities in Apache Tomcat stem from various issues, including a denial of service (DoS) in multipart uploads (CVE-2025-48988), security constraint bypass for pre/post-resources (CVE-2025-49125), and multiple DoS attacks through HTTP/2 control frames (CVE-2025-48989). These vulnerabilities could allow attackers to exploit the server's resources, leading to service interruptions and potential data loss. The impact of these vulnerabilities can be severe, especially in production environments where uptime is critical.
How To Fix
Minimum fixed version
1:9.0.87-3.el9_6.3
This is the first release that contains the fix.
sudo dnf update tomcatTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing rate limiting on your server to mitigate the impact of potential DoS attacks. Additionally, review your server's configuration to disable unnecessary features that may expose vulnerabilities.
Conclusion
In summary, the recent vulnerabilities in Apache Tomcat present significant risks that could lead to denial of service attacks. It is crucial to update to the patched version to ensure the security and stability of your applications. Utilizing tools like Vulert can assist in monitoring for vulnerabilities and maintaining a secure environment.
See every vulnerability recorded for tomcat →
FAQ
The vulnerabilities primarily involve denial of service attacks that can disrupt the normal functioning of the server, potentially leading to downtime.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By uploading your manifest file, you can check for vulnerabilities without needing to install any software.
The vulnerabilities are associated with the following CVEs: CVE-2025-48976, CVE-2025-48988, CVE-2025-48989, CVE-2025-49125, CVE-2025-52434, CVE-2025-52520, and CVE-2025-53506.
While the primary risk is service disruption, there is a potential for data loss if the server becomes unresponsive during an attack.
Implementing rate limiting and reviewing server configurations to disable unnecessary features can help mitigate risks until you can apply the updates.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat.
