CVE-2025-48988CWE-770

Apache Tomcat: FileUpload large number of parts with headers DoS

High · published June 16, 2025

CVSS v3.1
7.5
EPSS
31%
Percentile
98.2
In the wild
Unconfirmed
What it is

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.

The following versions were EOL at the time the CVE was created but are

known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions

may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.30515 · 98.2th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2025-06-16T14:13Z
EPSS history
Timeline
  • 19 SEP 03:48Z
    EPSS moved 59% → 31%
    epss
  • 18 SEP 03:27Z
    EPSS moved 59% → 31%
    epss
  • 16 JUN 14:13Z
    Apache Tomcat: FileUpload large number of parts with headers DoS
    cvelistv5