Moderate severityNVD Advisory· Published Jul 10, 2025· Updated Nov 4, 2025
Apache Tomcat: APR/Native Connector crash leading to DoS
CVE-2025-52434
Description
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.
This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 9.0.107, which fixes the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.tomcat:tomcat-utilMaven | >= 9.0.0.M1, < 9.0.107 | 9.0.107 |
org.apache.tomcat:tomcat-utilMaven | >= 8.5.0, <= 8.5.100 | — |
Affected products
39- osv-coords38 versionspkg:apk/chainguard/tomcat-8.5.87-jamf-compatpkg:bitnami/tomcatpkg:maven/org.apache.tomcat/tomcat-utilpkg:rpm/almalinux/tomcatpkg:rpm/almalinux/tomcat9pkg:rpm/almalinux/tomcat9-admin-webappspkg:rpm/almalinux/tomcat9-docs-webapppkg:rpm/almalinux/tomcat9-el-3.0-apipkg:rpm/almalinux/tomcat9-jsp-2.3-apipkg:rpm/almalinux/tomcat9-libpkg:rpm/almalinux/tomcat9-servlet-4.0-apipkg:rpm/almalinux/tomcat9-webappspkg:rpm/almalinux/tomcat-admin-webappspkg:rpm/almalinux/tomcat-docs-webapppkg:rpm/almalinux/tomcat-el-3.0-apipkg:rpm/almalinux/tomcat-jsp-2.3-apipkg:rpm/almalinux/tomcat-libpkg:rpm/almalinux/tomcat-servlet-4.0-apipkg:rpm/almalinux/tomcat-webappspkg:rpm/opensuse/tomcat&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/tomcat&distro=openSUSE%20Tumbleweedpkg:rpm/suse/tomcat&distro=SUSE%20Enterprise%20Storage%207.1pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSSpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOSpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSSpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOSpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSSpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP6pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP7pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSSpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSSpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSSpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSSpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5pkg:rpm/suse/tomcat&distro=SUSE%20Manager%20Server%20LTS%204.3
< 8.5.87-r3+ 37 more
- (no CPE)range: < 8.5.87-r3
- (no CPE)range: >= 9.0.0, < 9.0.107
- (no CPE)range: >= 9.0.0.M1, < 9.0.107
- (no CPE)range: < 1:9.0.87-1.el8_10.6
- (no CPE)range: < 1:9.0.87-5.el10_0.3
- (no CPE)range: < 1:9.0.87-5.el10_0.3
- (no CPE)range: < 1:9.0.87-5.el10_0.3
- (no CPE)range: < 1:9.0.87-5.el10_0.3
- (no CPE)range: < 1:9.0.87-5.el10_0.3
- (no CPE)range: < 1:9.0.87-5.el10_0.3
- (no CPE)range: < 1:9.0.87-5.el10_0.3
- (no CPE)range: < 1:9.0.87-5.el10_0.3
- (no CPE)range: < 1:9.0.87-1.el8_10.6
- (no CPE)range: < 1:9.0.87-1.el8_10.6
- (no CPE)range: < 1:9.0.87-1.el8_10.6
- (no CPE)range: < 1:9.0.87-1.el8_10.6
- (no CPE)range: < 1:9.0.87-1.el8_10.6
- (no CPE)range: < 1:9.0.87-1.el8_10.6
- (no CPE)range: < 1:9.0.87-1.el8_10.6
- (no CPE)range: < 9.0.108-150200.91.1
- (no CPE)range: < 9.0.107-1.1
- (no CPE)range: < 9.0.108-150200.91.1
- (no CPE)range: < 9.0.108-150200.91.1
- (no CPE)range: < 9.0.108-150200.91.1
- (no CPE)range: < 9.0.108-150200.91.1
- (no CPE)range: < 9.0.108-150200.91.1
- (no CPE)range: < 9.0.108-150200.91.1
- (no CPE)range: < 9.0.108-150200.91.1
- (no CPE)range: < 9.0.108-150200.91.1
- (no CPE)range: < 9.0.115-3.160.1
- (no CPE)range: < 9.0.108-150200.91.1
- (no CPE)range: < 9.0.108-150200.91.1
- (no CPE)range: < 9.0.108-150200.91.1
- (no CPE)range: < 9.0.108-150200.91.1
- (no CPE)range: < 9.0.108-150200.91.1
- (no CPE)range: < 9.0.108-150200.91.1
- (no CPE)range: < 9.0.115-3.160.1
- (no CPE)range: < 9.0.108-150200.91.1
- Apache Software Foundation/Apache Tomcatv5Range: 9.0.0.M1
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-4j3c-42xv-3f84ghsaADVISORY
- lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030ghsavendor-advisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2025-52434ghsaADVISORY
- www.openwall.com/lists/oss-security/2025/07/10/11ghsaWEB
- github.com/apache/tomcat/commit/8a83c3c42d20762782678932c14005cd3397a018ghsaWEB
- lists.debian.org/debian-lts-announce/2025/07/msg00009.htmlghsaWEB
News mentions
0No linked articles in our index yet.