CVE-2025-53506CWE-400

Apache Tomcat: DoS via excessive h2 streams at connection start

High · published July 10, 2025

CVSS v3.1
7.5
EPSS
2%
Percentile
81.8
In the wild
Unconfirmed
What it is

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.

The following versions were EOL at the time the CVE was created but are

known to be affected: 8.5.0 through 8.5.100. Other EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.02129 · 81.8th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2025-07-10T19:14Z
EPSS history
Timeline
  • 10 JUL 19:14Z
    Apache Tomcat: DoS via excessive h2 streams at connection start
    cvelistv5