7.5

CVE-2025-48988: Apache Tomcat: FileUpload large number of parts with headers DoS

Modified
AliasesUBUNTU-CVE-2025-48988DEBIAN-CVE-2025-48988CGA-286w-qfqg-45r7
Published 16-06-2025Last modified 03-11-2025

Vulnerability summary

CVE-2025-48988 is a high (CVSS 7.5) vulnerability in apache software foundation apache tomcat. EPSS estimates a 30.43% chance of exploitation in the next 30 days, higher than 98.2% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 30% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
30.43%
0%100%
High · -0.08 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 20 · Related 9
DLA-4244-1DSA-6120-1DSA-6121-1MGASA-2025-0191OPENSUSE-SU-2025:15301-1OPENSUSE-SU-2025:15302-1

Timeline

  1. 16-06-2025
    PublishedVulnerability first disclosed.
  2. 03-11-2025
    Last modifiedVulnerability information updated.

Description

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

CVSS metrics

8 scores · 7 sources · 2 versions

EPSS trend

Probability

30.43%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

Decrease -0.08 pp

From 30.51% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard7 products
  • camunda-zeebe-8.6< 8.6.18-r2
  • camunda-zeebe-8.6-compat< 8.6.18-r2
  • thingsboard< 4.0.1-r8
  • thingsboard-tb-js-executor< 4.0.1-r8
  • thingsboard-tb-mqtt-transport< 4.0.1-r8
Ubuntu6 products
  • tomcat10All versions (No fix recorded)
  • tomcat11All versions (No fix recorded)
  • tomcat6All versions (No fix recorded)
  • tomcat7All versions (No fix recorded)
  • tomcat8All versions (No fix recorded)
Wolfi5 products
  • thingsboard< 4.0.1-r8
  • thingsboard-tb-js-executor< 4.0.1-r8
  • thingsboard-tb-mqtt-transport< 4.0.1-r8
  • thingsboard-tb-node< 4.0.1-r8
  • thingsboard-tb-web-ui< 4.0.1-r8
Debian3 products
  • tomcat10< 10.1.52-1~deb12u1 | < 10.1.52-1~deb13u1 | < 10.1.46-1
  • tomcat11< 11.0.15-1~deb13u1 | < 11.0.11-1
  • tomcat9< 9.0.70-2
Apache1 product
  • tomcat≥ 9.0.0, < 9.0.106 | ≥ 10.1.0, < 10.1.42 | ≥ 11.0.0, < 11.0.8
Apache software foundation1 product
  • apache tomcat≥ 11.0.0-M1, ≤ 11.0.7 | ≥ 10.1.0-M1, ≤ 10.1.41 | ≥ 9.0.0.M1, ≤ 9.0.105 | ≥ 8.5.0, ≤ 8.5.100
Org.apache.tomcat1 product
  • tomcat-catalina≥ 11.0.0-M1, < 11.0.8 | ≥ 10.1.0-M1, < 10.1.42 | ≥ 9.0.0.M1, < 9.0.106 | ≥ 8.5.0, ≤ 8.5.100
Org.apache.tomcat.embed1 product
  • tomcat-embed-core≥ 11.0.0-M1, < 11.0.8 | ≥ 10.1.0-M1, < 10.1.42 | ≥ 9.0.0.M1, < 9.0.106 | ≥ 8.5.0, ≤ 8.5.100

8 vendors · 25 products

References

15 links
Show all 15 references