CVE-2025-52434
📋 TL;DR
A race condition vulnerability in Apache Tomcat's APR/Native connector when handling HTTP/2 connection closures can lead to crashes or denial of service. This affects Tomcat versions 9.0.0.M1 through 9.0.106 and EOL versions 8.5.0 through 8.5.100. Systems using the APR/Native connector with HTTP/2 enabled are vulnerable.
💻 Affected Systems
- Apache Tomcat
📦 What is this software?
Tomcat by Apache
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption through denial of service, potentially causing application downtime and availability issues.
Likely Case
Intermittent crashes or instability of Tomcat instances, leading to degraded performance and service interruptions.
If Mitigated
Minimal impact if HTTP/2 is disabled or APR/Native connector is not used.
🎯 Exploit Status
Exploitation requires specific timing conditions and HTTP/2 usage, making it moderately complex but achievable.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.0.107
Vendor Advisory: https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030
Restart Required: Yes
Instructions:
1. Download Tomcat 9.0.107 or later from Apache website. 2. Stop Tomcat service. 3. Backup current installation. 4. Replace with patched version. 5. Restart Tomcat service.
🔧 Temporary Workarounds
Disable HTTP/2
allDisable HTTP/2 protocol to prevent exploitation of this race condition.
Edit server.xml and remove or comment out HTTP/2 connector configurations
Use alternative connector
allSwitch from APR/Native connector to NIO or NIO2 connector.
Modify server.xml to use <Connector protocol="org.apache.coyote.http11.Http11NioProtocol" ...>
🧯 If You Can't Patch
- Implement network segmentation to restrict access to Tomcat instances
- Deploy web application firewall (WAF) with rate limiting and anomaly detection
🔍 How to Verify
Check if Vulnerable:
Check Tomcat version and connector configuration in server.xml for APR/Native with HTTP/2.Check Version:
catalina.sh version (Unix) or version.bat (Windows)Verify Fix Applied:
Verify Tomcat version is 9.0.107 or higher and check that service remains stable under load.📡 Detection & Monitoring
Log Indicators:
- Unexpected connection resets
- Thread dump showing race conditions
- HTTP/2 connection closure errors
Network Indicators:
- Abnormal HTTP/2 connection termination patterns
- Increased 5xx errors from Tomcat
SIEM Query:
source="tomcat" AND ("connection reset" OR "race condition" OR "HTTP/2 error")