GHSA-4j3c-42xv-3f84

Source

https://github.com/advisories/GHSA-4j3c-42xv-3f84

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-4j3c-42xv-3f84/GHSA-4j3c-42xv-3f84.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-4j3c-42xv-3f84

Aliases

CVE-2025-52434

Downstream

MINI-m2rv-5cx3-9cc2

MINI-q99c-7xc5-f8vw

Published

2025-07-10T21:31:52Z

Modified

2025-07-11T23:34:07.254859Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U CVSS Calculator

Summary

Apache Tomcat Utilities is vulnerable to resource exhaustion when using the APR/Native connector

Details

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.

This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 9.0.107, which fixes the issue.

Database specific

{
    "cwe_ids": [
        "CWE-362"
    ],
    "github_reviewed_at": "2025-07-10T22:55:26Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": "2025-07-10T19:15:25Z"
}

References

Affected packages

Maven / org.apache.tomcat:tomcat-util

Package

Name: org.apache.tomcat:tomcat-util; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomcat/tomcat-util

Affected ranges

Type: ECOSYSTEM
Events: Introduced

9.0.0.M1

Fixed

9.0.107

Affected versions

9.*

9.0.0.M1

9.0.0.M3

9.0.0.M4

9.0.0.M6

9.0.0.M8

9.0.0.M9

9.0.0.M10

9.0.0.M11

9.0.0.M13

9.0.0.M15

9.0.0.M17

9.0.0.M18

9.0.0.M19

9.0.0.M20

9.0.0.M21

9.0.0.M22

9.0.0.M25

9.0.0.M26

9.0.0.M27

9.0.1

9.0.2

9.0.4

9.0.5

9.0.6

9.0.7

9.0.8

9.0.10

9.0.11

9.0.12

9.0.13

9.0.14

9.0.16

9.0.17

9.0.19

9.0.20

9.0.21

9.0.22

9.0.24

9.0.26

9.0.27

9.0.29

9.0.30

9.0.31

9.0.33

9.0.34

9.0.35

9.0.36

9.0.37

9.0.38

9.0.39

9.0.40

9.0.41

9.0.43

9.0.44

9.0.45

9.0.46

9.0.48

9.0.50

9.0.52

9.0.53

9.0.54

9.0.55

9.0.56

9.0.58

9.0.59

9.0.60

9.0.62

9.0.63

9.0.64

9.0.65

9.0.67

9.0.68

9.0.69

9.0.70

9.0.71

9.0.72

9.0.73

9.0.74

9.0.75

9.0.76

9.0.78

9.0.79

9.0.80

9.0.81

9.0.82

9.0.83

9.0.84

9.0.85

9.0.86

9.0.87

9.0.88

9.0.89

9.0.90

9.0.91

9.0.93

9.0.94

9.0.95

9.0.96

9.0.97

9.0.98

9.0.99

9.0.100

9.0.102

9.0.104

9.0.105

9.0.106