CVE-2025-52520
📋 TL;DR
An integer overflow vulnerability in Apache Tomcat's multipart upload handling allows attackers to bypass configured size limits, potentially causing denial of service. This affects Tomcat versions 11.0.0-M1 through 11.0.8, 10.1.0-M1 through 10.1.42, and 9.0.0.M1 through 9.0.106, with older EOL versions also potentially vulnerable. The vulnerability requires specific multipart upload configurations to be exploitable.
💻 Affected Systems
- Apache Tomcat
📦 What is this software?
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption through resource exhaustion, potentially crashing the Tomcat instance and affecting all hosted applications.
Likely Case
Partial service degradation or temporary unavailability of affected Tomcat instances when exploited.
If Mitigated
Minimal impact if size limits are properly configured and monitored, with potential for brief service interruptions.
🎯 Exploit Status
Exploitation requires knowledge of specific vulnerable multipart configurations and ability to send crafted requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.0.9, 10.1.43, or 9.0.107
Vendor Advisory: https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5
Restart Required: Yes
Instructions:
1. Download the patched version from Apache Tomcat website. 2. Stop the Tomcat service. 3. Backup current installation. 4. Replace with patched version. 5. Restart Tomcat service.
🔧 Temporary Workarounds
Disable multipart upload
allIf multipart upload functionality is not required, disable it in Tomcat configuration to prevent exploitation.
Edit server.xml to remove or comment out multipart configuration
Implement request size limits
allConfigure strict request size limits at the web server or load balancer level to prevent large uploads.
Configure maxPostSize parameter in Tomcat connector configuration
🧯 If You Can't Patch
- Implement network-level controls to restrict access to Tomcat management interfaces
- Deploy WAF rules to detect and block suspicious multipart upload patterns
🔍 How to Verify
Check if Vulnerable:
Check Tomcat version and multipart configuration in server.xml and web.xml filesCheck Version:
java -cp "$CATALINA_HOME/lib/catalina.jar" org.apache.catalina.util.ServerInfoVerify Fix Applied:
Verify Tomcat version is 11.0.9, 10.1.43, 9.0.107 or higher using version check command📡 Detection & Monitoring
Log Indicators:
- Unusually large multipart upload requests
- Request size limit exceeded errors
- OutOfMemory errors in Tomcat logs
Network Indicators:
- Large HTTP POST requests to Tomcat endpoints
- Multiple rapid multipart upload attempts
SIEM Query:
source="tomcat" AND ("multipart" OR "upload") AND size>1000000