CVE-2025-61795
BaseFortify
Publication date: 2025-10-27
Last updated on: 2025-11-14
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | tomcat | From 8.5.0 (inc) to 8.5.100 (inc) |
| apache | tomcat | From 9.0.0 (inc) to 9.0.110 (exc) |
| apache | tomcat | From 10.0.0 (inc) to 10.0.27 (exc) |
| apache | tomcat | From 10.1.0 (inc) to 10.1.47 (exc) |
| apache | tomcat | From 11.0.0 (inc) to 11.0.12 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-404 | The product does not release or incorrectly releases a resource before it is made available for re-use. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Apache Tomcat involves improper resource shutdown or release during multipart uploads. When an error occurs while processing these uploads, temporary files created on disk are not immediately deleted but instead rely on the garbage collection process to remove them. Depending on JVM settings, memory usage, and load, these temporary files can accumulate faster than they are cleaned up, potentially causing a denial of service (DoS) by filling up disk space.
How can this vulnerability impact me? :
The vulnerability can lead to a denial of service (DoS) condition by exhausting disk space with leftover temporary files from multipart uploads that are not promptly deleted. This can degrade application performance or cause the application to become unavailable until the disk space is freed.
What immediate steps should I take to mitigate this vulnerability?
Users are recommended to upgrade Apache Tomcat to version 11.0.12 or later, 10.1.47 or later, or 9.0.110 or later which fixes the issue. This upgrade addresses the improper resource shutdown or release vulnerability related to multipart upload temporary files not being cleaned up promptly, preventing potential denial of service.