CVE-2025-53506

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

References

Affected packages

Debian:12 / tomcat10

Package

Name: tomcat10
Purl: pkg:deb/debian/tomcat10?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

10.*

10.1.6-1

10.1.6-1+deb12u1

10.1.6-1+deb12u2

10.1.7-1

10.1.8-1

10.1.9-1

10.1.10-1

10.1.13-1

10.1.14-1

10.1.15-1

10.1.16-1

10.1.20-1

10.1.23-1

10.1.25-1~bpo12+1

10.1.25-1

10.1.25-2

10.1.30-1~bpo12+1

10.1.30-1

10.1.31-1

10.1.33-1~bpo12+1

10.1.33-1

10.1.34-0+deb12u1

10.1.34-0+deb12u2

10.1.34-1

10.1.35-1

10.1.40-1~bpo12+1

10.1.40-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / tomcat10

Package

Name: tomcat10
Purl: pkg:deb/debian/tomcat10?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

10.*

10.1.40-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / tomcat11

Package

Name: tomcat11
Purl: pkg:deb/debian/tomcat11?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

11.*

11.0.6-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:11 / tomcat9

Package

Name: tomcat9
Purl: pkg:deb/debian/tomcat9?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

9.0.107-0+deb11u1

Affected versions

9.*

9.0.43-1

9.0.43-2~deb11u1

9.0.43-2~deb11u2

9.0.43-2~deb11u3

9.0.43-2~deb11u4

9.0.43-2~deb11u5

9.0.43-2~deb11u6

9.0.43-2~deb11u7

9.0.43-2~deb11u8

9.0.43-2~deb11u9

9.0.43-2~deb11u10

9.0.43-2~deb11u11

9.0.43-2~deb11u12

9.0.43-2

9.0.43-3

9.0.53-1

9.0.54-1

9.0.55-1

9.0.58-1

9.0.62-1

9.0.63-1

9.0.64-1

9.0.64-2

9.0.65-1

9.0.67-1

9.0.68-1

9.0.68-1.1

9.0.70-1

9.0.70-2

9.0.95-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / tomcat9

Package

Name: tomcat9
Purl: pkg:deb/debian/tomcat9?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

9.0.70-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / tomcat9

Package

Name: tomcat9
Purl: pkg:deb/debian/tomcat9?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

9.0.70-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/apache/tomcat

Affected ranges

Type: GIT
Repo: https://github.com/apache/tomcat
Events: Introduced

e9d17cddc285615807ec5fef09240777436b25dc

Last affected

0289da4f342744334e0fc5a53ee958e68024fead

Introduced

16bf392c67833ad549733b58c350ff92b5ee782a

Last affected

05ccf0c3e22d388f0cf853e32485d8249d051f2f

Introduced

56e547d387ab49f688c93fe9ca082b1b5d94deed

Last affected

8a48dcb90f13f1670632e763e945f4cc9ef869e6