Apache Tomcat Flaws Allow Auth Bypass and DoS Attacks
The Apache Software Foundation has released critical security updates to address four newly discovered vulnerabilities in Apache Tomcat, a widely used open-source Java servlet container.
The Apache Software Foundation has released critical security updates to address four newly discovered vulnerabilities in Apache Tomcat, a widely used open-source Java servlet container.
These vulnerabilities affect Tomcat versions 9.0, 10.1, and 11.0, exposing systems to denial-of-service (DoS) attacks, privilege escalation, installer abuse, and authentication bypass. Users are urged to update their deployments immediately.
CVE ID Severity Description Affected Versions
CVE-2025-48976 Important DoS via Multipart Header Overload 11.0.0-M1–11.0.7, 10.1.0-M1–10.1.41, 9.0.0.M1–9.0.105
CVE-2025-48988 Important Multipart Upload Abuse Enables DoS 11.0.0-M1–11.0.7, 10.1.0-M1–10.1.41, 9.0.0.M1–9.0.105
CVE-2025-49124 Low Windows Installer Side-Loading Risk 11.0.0-M1–11.0.7, 10.1.0–10.1.41, 9.0.23–9.0.105
CVE-2025-49125 Moderate Security Constraint Bypass in Pre/PostResources 11.0.0-M1–11.0.7, 10.1.0-M1–10.1.41, 9.0.0.M1–9.0.105
Attackers could exploit this by sending requests with numerous multipart headers, leading to excessive memory usage and a denial-of-service attack.
CVE-2025-48976: DoS via Multipart Header Overload
This vulnerability is due to Apache Commons FileUpload’s hard-coded 10kB limit for multipart header sizes. Attackers could exploit this by sending requests with numerous multipart headers, leading to excessive memory usage and a denial-of-service attack. The update introduces a configurable maxPartHeaderSize attribute, defaulting to 512 bytes.
CVE-2025-48988: Multipart Upload Abuse Enables DoS
Tomcat’s previous handling of multipart uploads allowed attackers to flood servers with multipart requests, exhausting memory resources. Administrators can now set a maxPartCount (default: 10 parts), reducing the risk of DoS attacks from multipart upload abuse.
CVE-2025-49124: Windows Installer Side-Loading Risk
On Windows, the Tomcat installer invoked icacls.exe without specifying a full path, which could lead to side-loading attacks. The fix ensures the installer uses a fully qualified path to icacls.exe .
CVE-2025-49125: Security Constraint Bypass in Pre/PostResources
This flaw affects deployments using PreResources or PostResources mounted outside the web application root. Attackers could access these resources via alternate paths, bypassing security constraints. The patch corrects resource path handling to ensure all paths are protected.
Administrators are advised to upgrade to Apache Tomcat 11.0.8, 10.1.42, or 9.0.106 to address these vulnerabilities. The Apache Software Foundation credits the TERASOLUNA Framework Security Team of NTT DATA Group Corporation and T. Doğa Gelişli for identifying these issues. Prompt patching is essential to prevent exploitation, service outages, or unauthorized access.
Based on reporting by GBHackers.