Sign in
Deutsch English Español Polski
Medium

Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector

  • Disclosed: 10.07.2025
  • Updated: 11.10.2026 12:22

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.

This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 9.0.107, which fixes the issue.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) org.apache.tomcat.embed:tomcat-embed-core >= 9.0.0.M1, < 9.0.107, >= 8.5.0, <= 8.5.100 9.0.107
Java / Kotlin (Maven) org.apache.tomcat:tomcat-coyote >= 9.0.0.M1, < 9.0.107, >= 8.5.0, <= 8.5.100 9.0.107

References

CVSS score 7.5/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE)
CWE-362
Platform
Java / Kotlin (Maven)
Package
org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-coyote
Disclosed
10.07.2025
Updated
11.10.2026 12:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-4j3c-42xv-3f84 - CC BY 4.0

Vulnerability history: org.apache.tomcat:tomcat-coyote

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (33) in the archive
Total entries
33
First → latest
06.2020 05.2026
Without a fix
0
Exploited in attacks
1

Severity breakdown

  • Critical 2
  • High 17
  • Medium 13
  • Low 1

Disclosures per year

Severity:
  1. Apache Tomcat - HTTP/2 request headers not validated
    Critical · 9.8 CVE-2026-41293 >= 8.5.0, < 9.0.118, >= 10.1.0-M1, < 10.1.55, >= 11.0.0-M1, < 11.0.22 9.0.118, 10.1.55, 11.0.22
  2. Apache Tomcat has an HTTP Request/Response Smuggling vulnerability
    High · 7.5 CVE-2026-24880 >= 7.0.0, < 9.0.116, >= 10.1.0-M1, < 10.1.52, >= 11.0.0-M1, < 11.0.20 9.0.116, 10.1.52, 11.0.20
  3. Apache Tomcat: Configured cipher preference order not preserved
    High · 7.5 CVE-2026-29129 >= 9.0.114, < 9.0.116, >= 10.1.51, < 10.1.53, >= 11.0.16, < 11.0.20 9.0.116, 10.1.53, 11.0.20
  4. Apache Tomcat has an Improper Input Validation vulnerability
    High · 7.5 CVE-2026-24734 >= 11.0.0-M1, < 11.0.18, >= 10.1.0-M7, < 10.1.52, >= 9.0.83, < 9.0.115 11.0.18, 10.1.52, 9.0.115
  5. Apache Tomcat Improper Resource Shutdown or Release vulnerability
    High · 7.5 CVE-2025-48989 >= 11.0.0-M1, < 11.0.10, >= 10.1.0-M1, < 10.1.44, >= 9.0.0.M1, < 9.0.108 11.0.10, 10.1.44, 9.0.108
  6. Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams
    High · 7.5 CVE-2025-53506 >= 11.0.0-M1, < 11.0.9, >= 10.1.0-M1, < 10.1.43, >= 9.0.0.M1, < 9.0.107, >= 8.5.0, <= 8.5.100 11.0.9, 10.1.43, 9.0.107
  7. Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector this entry
    Medium · 7.5 CVE-2025-52434 >= 9.0.0.M1, < 9.0.107, >= 8.5.0, <= 8.5.100 9.0.107
  8. Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability
    High · 8.6 CVE-2024-38286 >= 11.0.0-M1, < 11.0.0-M21, >= 10.1.0-M1, < 10.1.25, >= 9.0.13, < 9.0.90, >= 8.5.35, <= 8.5.100, >= 7.0.92, <= 7.0.109 11.0.0-M21, 10.1.25, 9.0.90
  9. Apache Tomcat - Denial of Service
    High · 7.5 CVE-2024-34750 >= 11.0.0-M1, < 11.0.0-M21, >= 10.1.0-M1, < 10.1.25, >= 9.0.0-M1, < 9.0.90, >= 8.5.0, <= 8.5.100 11.0.0-M21, 10.1.25, 9.0.90
  10. Apache Tomcat Improper Input Validation vulnerability
    High · 7.5 CVE-2023-46589 >= 11.0.0-M1, < 11.0.0-M11 11.0.0-M11
  11. Apache Tomcat - Fix for CVE-2023-24998 was incomplete
    High · 7.5 CVE-2023-28709 >= 8.5.85, < 8.5.88 8.5.88
  12. Apache Tomcat vulnerable to information leak
    High · 7.5 CVE-2023-34981 >= 8.5.88, < 8.5.89 8.5.89
  13. Apache Commons FileUpload denial of service vulnerability
    High · 7.5 CVE-2023-24998 >= 10.1.0-M1, < 10.1.5, >= 11.0.0-M2, < 11.0.0-M5, >= 8.5.85, < 8.5.88, >= 9.0.0-M1, < 9.0.71 10.1.5, 11.0.0-M5, 8.5.88, 9.0.71
  14. Apache Tomcat may reject request containing invalid Content-Length header
    High · 7.5 CVE-2022-42252 >= 9.0.0-M1, < 9.0.68, >= 10.0.0-M1, < 10.0.27, >= 10.1.0-M1, < 10.1.1 9.0.68, 10.0.27, 10.1.1
  15. Expected Behavior Violation in Apache Tomcat
    Critical · 9.8 CVE-2017-5651 >= 9.0.0.M1, < 9.0.0.M19, >= 8.5.0, < 8.5.13 9.0.0.M19, 8.5.13
  16. Improper Input Validation in Apache Tomcat
    High · 7.1 CVE-2016-6816 >= 9.0.0.M1, < 9.0.0.M12, >= 8.5.0, < 8.5.8, >= 8.0.0RC1, < 8.0.39, >= 7.0.0, < 7.0.73, >= 6.0.0, < 6.0.48 9.0.0.M12, 8.5.8, 8.0.39, 7.0.73, 6.0.48
  17. Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
    High · 7.5 CVE-2020-17527 >= 10.0.0-M1, < 10.0.0-M10, >= 9.0.0-M1, < 9.0.40, >= 8.5.0, < 8.5.60 10.0.0-M10, 9.0.40, 8.5.60
  18. Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat
    High · 7.5 CVE-2020-13934 >= 10.0.0-M1, < 10.0.0-M6, >= 9.0.0.M5, < 9.0.36, >= 8.5.1, < 8.5.56 10.0.0-M6, 9.0.36, 8.5.56
  19. Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
    High · 7.5 CVE-2021-25122 >= 10.0.0-M1, < 10.0.2 10.0.2
  20. Apache Tomcat Denial of Service vulnerability
    High · 7.5 CVE-2019-0199 >= 9.0.0, < 9.0.16, >= 8.0.0, < 8.5.38 9.0.16, 8.5.38

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.