CVE-2025-48988

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-48988
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-48988.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-48988
Aliases
Downstream
CGA (14)
CLSA (11)
DEBIAN (1)
MGASA (1)
OESA (2)
openSUSE (3)
RHSA (9)
RLSA (4)
ROOT (1)
SUSE (4)
UBUNTU (1)
Related
ALSA (3)
openSUSE (3)
SUSE (4)
Published
2025-06-16T14:13:40Z
Modified
2026-08-12T03:30:14Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Apache Tomcat: FileUpload large number of parts with headers DoS
Details

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Database specific 
{
    "cna_assigner":  "apache",
    "cwe_ids":  [
        "CWE-770"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48988.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "11.0.0-M1"
                },
                {
                    "last_affected":  "11.0.7"
                },
                {
                    "introduced":  "10.1.0-M1"
                },
                {
                    "last_affected":  "10.1.41"
                },
                {
                    "introduced":  "9.0.0.M1"
                },
                {
                    "last_affected":  "9.0.105"
                },
                {
                    "introduced":  "8.5.0"
                },
                {
                    "last_affected":  "8.5.100"
                }
            ],
            "source":  "AFFECTED_FIELD"
        },
        {
            "extracted_events":  [
                {
                    "introduced":  "11.0.0-M1"
                },
                {
                    "fixed":  "11.0.7"
                },
                {
                    "introduced":  "10.1.0-M1"
                },
                {
                    "fixed":  "10.1.41"
                },
                {
                    "introduced":  "9.0.0.M1"
                },
                {
                    "fixed":  "9.0.105"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}
References

Affected packages

Git / github.com/apache/tomcat

Affected ranges

Type
GIT
Repo
https://github.com/apache/tomcat
Events
Introduced
16bf392c67833ad549733b58c350ff92b5ee782a
Fixed
05ccf0c3e22d388f0cf853e32485d8249d051f2f
Introduced
e9d17cddc285615807ec5fef09240777436b25dc
Fixed
0289da4f342744334e0fc5a53ee958e68024fead
Introduced
56e547d387ab49f688c93fe9ca082b1b5d94deed
Fixed
8a48dcb90f13f1670632e763e945f4cc9ef869e6
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "9.0.0"
        },
        {
            "fixed":  "9.0.106"
        },
        {
            "introduced":  "10.1.0"
        },
        {
            "fixed":  "10.1.42"
        },
        {
            "introduced":  "11.0.0"
        },
        {
            "fixed":  "11.0.8"
        }
    ],
    "source":  "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-48988.json"