CVE-2025-53506

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-53506
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-53506.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-53506
Aliases
Downstream
ALSA (3)
CGA (18)
CLSA (10)
DEBIAN (1)
MGASA (1)
MINI (6)
OESA (6)
openSUSE (3)
RHSA (9)
RLSA (4)
ROOT (1)
SUSE (5)
UBUNTU (1)
Related
ALSA (3)
openSUSE (3)
SUSE (5)
Published
2025-07-10T19:14:23Z
Modified
2026-10-24T10:32:54Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Apache Tomcat: DoS via excessive h2 streams at connection start
Details

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

Database specific 
{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53506.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "11.0.0-M1"
                        },
                        {
                            "last_affected": "11.0.8"
                        },
                        {
                            "introduced": "10.1.0-M1"
                        },
                        {
                            "last_affected": "10.1.42"
                        },
                        {
                            "introduced": "9.0.0.M1"
                        },
                        {
                            "last_affected": "9.0.106"
                        },
                        {
                            "introduced": "8.5.0"
                        },
                        {
                            "last_affected": "8.5.100"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/apache/tomcat

Affected ranges

Type
GIT
Repo
https://github.com/apache/tomcat
Events
Introduced
16bf392c67833ad549733b58c350ff92b5ee782a
Last Affected
05ccf0c3e22d388f0cf853e32485d8249d051f2f
Introduced
e9d17cddc285615807ec5fef09240777436b25dc
Last Affected
0289da4f342744334e0fc5a53ee958e68024fead
Introduced
56e547d387ab49f688c93fe9ca082b1b5d94deed
Last Affected
8a48dcb90f13f1670632e763e945f4cc9ef869e6
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "9.0.0"
                },
                {
                    "last_affected": "9.0.106"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0"
                },
                {
                    "last_affected": "10.1.42"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "11.0.0"
                },
                {
                    "last_affected": "11.0.8"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-53506.json"