Resource Allocation Vulnerability in Apache Tomcat: CVE-2025-48988
Summary
CVE-2025-48988: Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. Affects tomcat10 versions >= 16bf392c67833ad549733b58c350ff92b5ee782a, < 05ccf0c3e22d388f0cf853e32485d8249d051f2f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java applications and provides a robust environment for running web applications. The affected versions of Tomcat include 11.0.0-M1 through 11.0.7, 10.1.0-M1 through 10.1.41, and 9.0.0.M1 through 9.0.105. This vulnerability arises from improper resource allocation, potentially leading to denial of service or resource exhaustion.
Vulnerability Detail
The vulnerability, identified as CVE-2025-48988, is categorized as an 'Allocation of Resources Without Limits or Throttling' issue. It affects multiple versions of Apache Tomcat, allowing attackers to exploit the resource allocation mechanism. This can lead to excessive resource consumption, causing the server to become unresponsive or crash. The flaw is rooted in the way Tomcat handles resource limits, which can be manipulated by malicious users to exhaust server resources.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to upgrade to the patched versions as soon as possible.
Conclusion
CVE-2025-48988 is a critical vulnerability affecting multiple versions of Apache Tomcat, allowing for resource exhaustion. Users are strongly advised to upgrade to the latest patched versions to protect their applications from potential denial of service attacks. Regular monitoring and timely updates are essential for maintaining security.
See every vulnerability recorded for tomcat10 →
FAQ
CVE-2025-48988 is a vulnerability in Apache Tomcat that allows for resource allocation without limits, potentially leading to denial of service.
The affected versions include Apache Tomcat 11.0.0-M1 through 11.0.7, 10.1.0-M1 through 10.1.41, and 9.0.0.M1 through 9.0.105.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
While there are no specific workarounds, it is crucial to plan an upgrade to the patched versions as soon as possible to mitigate the risk.
More information can be found in the official Apache Tomcat release notes and security advisories related to CVE-2025-48988.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat10.
