CVE-2025-48989

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-48989
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-48989.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-48989
Aliases
Downstream
Related
Published
2025-08-13T12:11:26.124Z
Modified
2026-07-11T03:53:47.501542628Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Apache Tomcat: h2 DoS - Made You Reset
Details

Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.

Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.

Database specific 
{
    "cna_assigner": "apache",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "11.0.0-M1"
                },
                {
                    "last_affected": "11.0.9"
                },
                {
                    "introduced": "10.1.0-M1"
                },
                {
                    "last_affected": "10.1.43"
                },
                {
                    "introduced": "9.0.0.M1"
                },
                {
                    "last_affected": "9.0.107"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "introduced": "11.0.0-M1"
                },
                {
                    "fixed": "11.0.9"
                },
                {
                    "introduced": "10.1.0-M1"
                },
                {
                    "fixed": "10.1.43"
                },
                {
                    "introduced": "9.0.0.M1"
                },
                {
                    "fixed": "9.0.107"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48989.json",
    "cwe_ids": [
        "CWE-404"
    ]
}
References

Affected packages

Git / github.com/apache/tomcat

Affected ranges

Type
GIT
Repo
https://github.com/apache/tomcat
Events
Introduced
3c78e95e36268dfb76db1570f0cf49104fa6eabc
Fixed
c63765c906c86af8afa43281f591d11ac5c9e5c1
Introduced
4c8b650437e2464c1c31c6598a263b3805b7a81f
Fixed
cbf143d52b79395ce8a7e749b7ccdcd9361751f9
Introduced
56e547d387ab49f688c93fe9ca082b1b5d94deed
Fixed
ea5f6b9485a94ca2fa86415b834a1a6c49a01f60
Introduced
29b07def810d335012e738b22ab44d4e232b50d1
Database specific 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "9.0.1"
        },
        {
            "fixed": "9.0.108"
        },
        {
            "introduced": "10.0.0"
        },
        {
            "fixed": "10.1.44"
        },
        {
            "introduced": "11.0.0"
        },
        {
            "fixed": "11.0.10"
        },
        {
            "introduced": "9.0.0-milestone1"
        },
        {
            "last_affected": "9.0.0-milestone1"
        },
        {
            "introduced": "9.0.0-milestone10"
        },
        {
            "last_affected": "9.0.0-milestone10"
        },
        {
            "introduced": "9.0.0-milestone11"
        },
        {
            "last_affected": "9.0.0-milestone11"
        },
        {
            "introduced": "9.0.0-milestone12"
        },
        {
            "last_affected": "9.0.0-milestone12"
        },
        {
            "introduced": "9.0.0-milestone13"
        },
        {
            "last_affected": "9.0.0-milestone13"
        },
        {
            "introduced": "9.0.0-milestone14"
        },
        {
            "last_affected": "9.0.0-milestone14"
        },
        {
            "introduced": "9.0.0-milestone15"
        },
        {
            "last_affected": "9.0.0-milestone15"
        },
        {
            "introduced": "9.0.0-milestone16"
        },
        {
            "last_affected": "9.0.0-milestone16"
        },
        {
            "introduced": "9.0.0-milestone17"
        },
        {
            "last_affected": "9.0.0-milestone17"
        },
        {
            "introduced": "9.0.0-milestone18"
        },
        {
            "last_affected": "9.0.0-milestone18"
        },
        {
            "introduced": "9.0.0-milestone19"
        },
        {
            "last_affected": "9.0.0-milestone19"
        },
        {
            "introduced": "9.0.0-milestone2"
        },
        {
            "last_affected": "9.0.0-milestone2"
        },
        {
            "introduced": "9.0.0-milestone20"
        },
        {
            "last_affected": "9.0.0-milestone20"
        },
        {
            "introduced": "9.0.0-milestone21"
        },
        {
            "last_affected": "9.0.0-milestone21"
        },
        {
            "introduced": "9.0.0-milestone22"
        },
        {
            "last_affected": "9.0.0-milestone22"
        },
        {
            "introduced": "9.0.0-milestone23"
        },
        {
            "last_affected": "9.0.0-milestone23"
        },
        {
            "introduced": "9.0.0-milestone24"
        },
        {
            "last_affected": "9.0.0-milestone24"
        },
        {
            "introduced": "9.0.0-milestone25"
        },
        {
            "last_affected": "9.0.0-milestone25"
        },
        {
            "introduced": "9.0.0-milestone26"
        },
        {
            "last_affected": "9.0.0-milestone26"
        },
        {
            "introduced": "9.0.0-milestone27"
        },
        {
            "last_affected": "9.0.0-milestone27"
        },
        {
            "introduced": "9.0.0-milestone3"
        },
        {
            "last_affected": "9.0.0-milestone3"
        },
        {
            "introduced": "9.0.0-milestone4"
        },
        {
            "last_affected": "9.0.0-milestone4"
        },
        {
            "introduced": "9.0.0-milestone5"
        },
        {
            "last_affected": "9.0.0-milestone5"
        },
        {
            "introduced": "9.0.0-milestone6"
        },
        {
            "last_affected": "9.0.0-milestone6"
        },
        {
            "introduced": "9.0.0-milestone7"
        },
        {
            "last_affected": "9.0.0-milestone7"
        },
        {
            "introduced": "9.0.0-milestone8"
        },
        {
            "last_affected": "9.0.0-milestone8"
        },
        {
            "introduced": "9.0.0-milestone9"
        },
        {
            "last_affected": "9.0.0-milestone9"
        }
    ]
}

Affected versions

9.*
9.0.0-milestone1
9.0.0-milestone10
9.0.0-milestone11
9.0.0-milestone12
9.0.0-milestone13
9.0.0-milestone14
9.0.0-milestone15
9.0.0-milestone16
9.0.0-milestone17
9.0.0-milestone18
9.0.0-milestone19
9.0.0-milestone2
9.0.0-milestone20
9.0.0-milestone21
9.0.0-milestone22
9.0.0-milestone23
9.0.0-milestone24
9.0.0-milestone25
9.0.0-milestone26
9.0.0-milestone27
9.0.0-milestone3
9.0.0-milestone4
9.0.0-milestone5
9.0.0-milestone6
9.0.0-milestone7
9.0.0-milestone8
9.0.0-milestone9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-48989.json"