CVE-2025-53506
📋 TL;DR
This vulnerability allows an attacker to cause a denial-of-service (DoS) condition in Apache Tomcat by exploiting an HTTP/2 protocol flaw. An uncooperative HTTP/2 client can prevent the server from properly limiting concurrent streams, leading to uncontrolled resource consumption. This affects Tomcat versions 9.0.0.M1 through 9.0.106, 10.1.0-M1 through 10.1.42, and 11.0.0-M1 through 11.0.8, as well as some EOL versions.
💻 Affected Systems
- Apache Tomcat
📦 What is this software?
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to resource exhaustion, affecting all HTTP/2 traffic to the Tomcat server.
Likely Case
Degraded performance or intermittent service disruptions under targeted attack.
If Mitigated
Minimal impact with proper network segmentation and rate limiting in place.
🎯 Exploit Status
Exploitation requires sending malformed HTTP/2 frames, which can be done with standard HTTP/2 client libraries.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.0.9, 10.1.43, or 9.0.107
Vendor Advisory: https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0
Restart Required: Yes
Instructions:
1. Download patched version from Apache Tomcat website. 2. Stop Tomcat service. 3. Backup configuration files. 4. Replace Tomcat installation with patched version. 5. Restore configuration files. 6. Start Tomcat service.
🔧 Temporary Workarounds
Disable HTTP/2
allDisable HTTP/2 protocol support in Tomcat configuration
Edit server.xml and remove or comment out HTTP/2 connector configuration
Implement Rate Limiting
linuxUse network-level rate limiting to restrict HTTP/2 connections
iptables -A INPUT -p tcp --dport 8443 -m connlimit --connlimit-above 100 --connlimit-mask 32 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to limit access to Tomcat HTTP/2 ports
- Deploy WAF or load balancer with HTTP/2 anomaly detection capabilities
🔍 How to Verify
Check if Vulnerable:
Check Tomcat version and verify HTTP/2 is enabled in server.xml configurationCheck Version:
catalina.sh version (Unix) or catalina.bat version (Windows)Verify Fix Applied:
Verify Tomcat version is 11.0.9+, 10.1.43+, or 9.0.107+ and test HTTP/2 functionality📡 Detection & Monitoring
Log Indicators:
- Unusual number of HTTP/2 connection attempts
- Resource exhaustion warnings in Tomcat logs
- Increased error rates for HTTP/2 requests
Network Indicators:
- High volume of HTTP/2 connections from single sources
- Malformed HTTP/2 frames in network traffic
SIEM Query:
source="tomcat" AND ("HTTP/2" OR "h2") AND ("error" OR "timeout" OR "resource")