CVE-2025-48988
📋 TL;DR
This CVE describes an allocation of resources without limits or throttling vulnerability in Apache Tomcat. Attackers can exploit this to cause denial of service by exhausting server resources. Affected users include those running vulnerable versions of Apache Tomcat web servers.
💻 Affected Systems
- Apache Tomcat
📦 What is this software?
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service causing service unavailability, potentially requiring server restart and impacting all hosted applications.
Likely Case
Degraded performance or temporary service disruption due to resource exhaustion.
If Mitigated
Minimal impact with proper resource limits and monitoring in place.
🎯 Exploit Status
Resource exhaustion vulnerabilities typically have low exploitation complexity and may not require authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.0.8, 10.1.42, or 9.0.106
Vendor Advisory: https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18
Restart Required: Yes
Instructions:
1. Download the patched version from Apache Tomcat website. 2. Stop the Tomcat service. 3. Backup configuration files. 4. Replace Tomcat installation with patched version. 5. Restore configuration files. 6. Start Tomcat service.
🔧 Temporary Workarounds
Implement connection limits
allConfigure connection limits and timeouts to mitigate resource exhaustion
Edit server.xml: <Connector port="8080" maxConnections="100" connectionTimeout="20000" ... />
Enable resource monitoring
allMonitor system resources and implement automatic restart thresholds
Implement monitoring with tools like Nagios, Zabbix, or custom scripts to track memory/CPU usage
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure
- Deploy web application firewall (WAF) with rate limiting capabilities
🔍 How to Verify
Check if Vulnerable:
Check Tomcat version against affected version rangesCheck Version:
Check catalina.sh version output or examine version.txt in Tomcat installation directoryVerify Fix Applied:
Verify Tomcat version is 11.0.8+, 10.1.42+, or 9.0.106+📡 Detection & Monitoring
Log Indicators:
- Unusual connection spikes
- OutOfMemory errors
- High thread count warnings
Network Indicators:
- Abnormal connection patterns
- Excessive requests from single sources
SIEM Query:
source="tomcat" AND ("OutOfMemory" OR "connection limit exceeded" OR thread_count>threshold)