CVE-2025-48989: Apache Tomcat denial of service in HTTP/2 via MadeYouReset

Executive brief

Apache Tomcat, a widely used web server and application container, is vulnerable to a denial-of-service condition. An attacker can exploit a flaw in how the server handles and releases resources to trigger a 'made you reset' attack. This could lead to service instability or unavailability, potentially disrupting business operations and customer access to web applications.

Technical details

A vulnerability classified as CWE-404 (Improper Resource Shutdown or Release) exists in Apache Tomcat's Coyote connector. The root cause is a failure to correctly release or shut down resources before they are made available for reuse. A remote, unauthenticated attacker can exploit this over the network to trigger a 'made you reset' attack, leading to a denial-of-service (DoS) condition by exhausting or mismanaging available resources. The issue is fixed in versions 11.0.10, 10.1.44, and 9.0.108.

Affected products

• Apache Tomcat 11.0.0-M1 to 11.0.9, 10.1.0-M1 to 10.1.43, 9.0.0.M1 to 9.0.107

Timeline

• 2025-08-13: disclosed
• 2025-08-13: advisory

References

• https://api.github.com/users/snieguu
• https://github.com/snieguu
• https://api.github.com/users/snieguu/gists%7B/gist_id%7D
• https://api.github.com/users/snieguu/repos
• https://avatars.githubusercontent.com/u/6084074?v=4
• https://api.github.com/users/snieguu/events%7B/privacy%7D