Executive brief
Apache Tomcat, a widely used web server for Java applications, contains a flaw in how it handles file uploads. When an error occurs during a large file upload, the server may fail to immediately delete temporary files, potentially filling up the server's storage space. This can lead to a denial-of-service (DoS) condition, making the web application unavailable to legitimate users.
Technical details
A vulnerability classified as Improper Resource Shutdown or Release (CWE-404) exists in Apache Tomcat's multipart upload handling. When an error occurs—such as exceeding file size limits—temporary file copies written to disk are not immediately deleted, instead relying on the JVM garbage collection process for cleanup. An attacker with low privileges can repeatedly trigger these errors to fill the server's disk space faster than the GC can reclaim it, resulting in a Denial of Service (DoS). The issue is present in versions 11.0.0-M1 through 11.0.11, 10.1.0-M1 through 10.1.46, 9.0.0.M1 through 9.0.109, and 8.5.x. Patches are available in versions 11.0.12, 10.1.47, and 9.0.110.
Affected products
- Apache Tomcat 11.0.0-M1 to 11.0.11, 10.1.0-M1 to 10.1.46, 9.0.0.M1 to 9.0.109, 8.5.0 to 8.5.100
Timeline
- 2025-10-27: disclosed
- 2025-10-27: advisory