GitHub Advisoryadvisory · Maven

GHSA-gqp3-2cvr-x8m3 Apache Tomcat Improper Resource Shutdown or Release vulnerability

HIGH Published 2025-08-13 Modified 2026-05-13 Official page ↗
Aliases
CVE-2025-48989
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat-coyote, org.apache.tomcat.embed:tomcat-embed-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-404
Reviewed
2025-08-13

Affected packages

• Maven org.apache.tomcat:tomcat-coyote: >= 11.0.0-M1, < 11.0.10 → fixed in 11.0.10 • Maven org.apache.tomcat:tomcat-coyote: >= 10.1.0-M1, < 10.1.44 → fixed in 10.1.44 • Maven org.apache.tomcat:tomcat-coyote: >= 9.0.0.M1, < 9.0.108 → fixed in 9.0.108 • Maven org.apache.tomcat.embed:tomcat-embed-core: >= 11.0.0-M1, < 11.0.10 → fixed in 11.0.10 • Maven org.apache.tomcat.embed:tomcat-embed-core: >= 10.1.0-M1, < 10.1.44 → fixed in 10.1.44 • Maven org.apache.tomcat.embed:tomcat-embed-core: >= 9.0.0.M1, < 9.0.108 → fixed in 9.0.108

Description

Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected. Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.

Related

Alias · CVE (1)

  • CVE-2025-48989 Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. vulnerability

Weakness · CWE (1)

  • CWE-404 Improper Resource Shutdown or Release weakness

References