Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/809?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/809?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.107", "type": "maven", "namespace": "org.apache.tomcat", "name": "tomcat", "version": "9.0.107", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "9.0.117", "latest_non_vulnerable_version": "11.0.21", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/4420?format=api", "vulnerability_id": "VCID-1e6p-cppr-2bh2", "summary": "Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-48989.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-48989.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-48989", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00241", "scoring_system": "epss", "scoring_elements": "0.47326", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00241", "scoring_system": "epss", "scoring_elements": "0.47319", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00241", "scoring_system": "epss", "scoring_elements": "0.47345", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00241", "scoring_system": "epss", "scoring_elements": "0.4732", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00241", "scoring_system": "epss", "scoring_elements": "0.47323", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00241", "scoring_system": "epss", "scoring_elements": "0.47268", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00241", "scoring_system": "epss", "scoring_elements": "0.47322", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00241", "scoring_system": "epss", "scoring_elements": "0.47302", "published_at": "2026-04-02T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-48989" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/apache/tomcat", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/tomcat" }, { "reference_url": "https://github.com/apache/tomcat/commit/73c04a10395774bda71a0b37802cf983662ce255", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/tomcat/commit/73c04a10395774bda71a0b37802cf983662ce255" }, { "reference_url": "https://github.com/apache/tomcat/commit/f362c8eb3b8ec5b7f312f7f5610731c0fb299a06", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/tomcat/commit/f362c8eb3b8ec5b7f312f7f5610731c0fb299a06" }, { "reference_url": "https://github.com/apache/tomcat/commit/f36b8a4eea4ce8a0bc035079e1d259d29f5eb7bf", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/tomcat/commit/f36b8a4eea4ce8a0bc035079e1d259d29f5eb7bf" }, { "reference_url": "https://lists.apache.org/thread/9ydfg0xr0tchmglcprhxgwhj0hfwxlyf", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-08-13T18:37:15Z/" } ], "url": "https://lists.apache.org/thread/9ydfg0xr0tchmglcprhxgwhj0hfwxlyf" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989" }, { "reference_url": "https://tomcat.apache.org/security-10.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://tomcat.apache.org/security-10.html" }, { "reference_url": "https://tomcat.apache.org/security-11.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://tomcat.apache.org/security-11.html" }, { "reference_url": "https://tomcat.apache.org/security-9.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://tomcat.apache.org/security-9.html" }, { "reference_url": "https://www.kb.cert.org/vuls/id/767506", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.kb.cert.org/vuls/id/767506" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2025/08/13/2", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2025/08/13/2" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111096", "reference_id": "1111096", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111096" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111097", "reference_id": "1111097", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111097" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309", "reference_id": "2373309", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48989", "reference_id": "CVE-2025-48989", "reference_type": "", "scores": [ { "value": "Important", "scoring_system": "apache_tomcat", "scoring_elements": "" } ], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48989" }, { "reference_url": "https://github.com/advisories/GHSA-gqp3-2cvr-x8m3", "reference_id": "GHSA-gqp3-2cvr-x8m3", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-gqp3-2cvr-x8m3" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:13685", "reference_id": "RHSA-2025:13685", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:13685" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:13686", "reference_id": "RHSA-2025:13686", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:13686" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14177", "reference_id": "RHSA-2025:14177", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14177" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14178", "reference_id": "RHSA-2025:14178", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14178" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14179", "reference_id": "RHSA-2025:14179", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14179" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14180", "reference_id": "RHSA-2025:14180", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14180" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14181", "reference_id": "RHSA-2025:14181", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14181" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14182", "reference_id": "RHSA-2025:14182", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14182" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14183", "reference_id": "RHSA-2025:14183", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14183" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:22924", "reference_id": "RHSA-2025:22924", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:22924" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:22925", "reference_id": "RHSA-2025:22925", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:22925" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/805?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.108", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-8war-4v58-eub2" }, { "vulnerability": "VCID-cfhw-vmcp-y3bc" }, { "vulnerability": "VCID-xqjr-7xfw-mbh2" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@9.0.108" }, { "url": "http://public2.vulnerablecode.io/api/packages/654?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.44", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-8war-4v58-eub2" }, { "vulnerability": "VCID-cfhw-vmcp-y3bc" }, { "vulnerability": "VCID-xqjr-7xfw-mbh2" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@10.1.44" }, { "url": "http://public2.vulnerablecode.io/api/packages/587?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@11.0.10", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-8war-4v58-eub2" }, { "vulnerability": "VCID-cfhw-vmcp-y3bc" }, { "vulnerability": "VCID-xqjr-7xfw-mbh2" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@11.0.10" } ], "aliases": [ "CVE-2025-48989", "GHSA-gqp3-2cvr-x8m3" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-1e6p-cppr-2bh2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/4414?format=api", "vulnerability_id": "VCID-8war-4v58-eub2", "summary": "Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.\n\nWhen using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed.\n\nThis issue affects Apache Tomcat Native: from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected.\n\nApache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue.\n\nApache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-24734.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-24734.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-24734", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00109", "scoring_system": "epss", "scoring_elements": "0.29186", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00109", "scoring_system": "epss", "scoring_elements": "0.29285", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00109", "scoring_system": "epss", "scoring_elements": "0.29279", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00109", "scoring_system": "epss", "scoring_elements": "0.29315", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00109", "scoring_system": "epss", "scoring_elements": "0.29175", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00109", "scoring_system": "epss", "scoring_elements": "0.29363", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00109", "scoring_system": "epss", "scoring_elements": "0.29239", "published_at": "2026-04-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-24734" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/apache/tomcat", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/tomcat" }, { "reference_url": "https://lists.apache.org/thread/292dlmx3fz1888v6v16221kpozq56gml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-21T21:16:49Z/" } ], "url": "https://lists.apache.org/thread/292dlmx3fz1888v6v16221kpozq56gml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24734", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24734" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440426", "reference_id": "2440426", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440426" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24734", "reference_id": "CVE-2026-24734", "reference_type": "", "scores": [ { "value": "Moderate", "scoring_system": "apache_tomcat", "scoring_elements": "" } ], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24734" }, { "reference_url": "https://github.com/advisories/GHSA-mgp5-rv84-w37q", "reference_id": "GHSA-mgp5-rv84-w37q", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-mgp5-rv84-w37q" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:5611", "reference_id": "RHSA-2026:5611", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:5611" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:5612", "reference_id": "RHSA-2026:5612", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:5612" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/791?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.115", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-35xg-a746-5qgc" }, { "vulnerability": "VCID-gyed-x6s8-ybhr" }, { "vulnerability": "VCID-maw6-4qs5-ykae" }, { "vulnerability": "VCID-rsxs-u5cc-rkgj" }, { "vulnerability": "VCID-yrzk-1dbk-muhy" }, { "vulnerability": "VCID-zw2q-kna8-mqcm" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@9.0.115" }, { "url": "http://public2.vulnerablecode.io/api/packages/641?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.52", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-35xg-a746-5qgc" }, { "vulnerability": "VCID-gyed-x6s8-ybhr" }, { "vulnerability": "VCID-maw6-4qs5-ykae" }, { "vulnerability": "VCID-rsxs-u5cc-rkgj" }, { "vulnerability": "VCID-yrzk-1dbk-muhy" }, { "vulnerability": "VCID-zw2q-kna8-mqcm" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@10.1.52" }, { "url": "http://public2.vulnerablecode.io/api/packages/577?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@11.0.18", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-35xg-a746-5qgc" }, { "vulnerability": "VCID-74tx-sx8a-guhs" }, { "vulnerability": "VCID-gyed-x6s8-ybhr" }, { "vulnerability": "VCID-rsxs-u5cc-rkgj" }, { "vulnerability": "VCID-yrzk-1dbk-muhy" }, { "vulnerability": "VCID-zw2q-kna8-mqcm" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@11.0.18" } ], "aliases": [ "CVE-2026-24734", "GHSA-mgp5-rv84-w37q" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-8war-4v58-eub2" } ], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/4471?format=api", "vulnerability_id": "VCID-9kfe-1esf-uydm", "summary": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.\n\nThis issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 9.0.107, which fixes the issue.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-52434.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-52434.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-52434", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00401", "scoring_system": "epss", "scoring_elements": "0.60729", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00401", "scoring_system": "epss", "scoring_elements": "0.60759", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00531", "scoring_system": "epss", "scoring_elements": "0.67312", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00531", "scoring_system": "epss", "scoring_elements": "0.67292", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00531", "scoring_system": "epss", "scoring_elements": "0.67278", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00531", "scoring_system": "epss", "scoring_elements": "0.67227", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00531", "scoring_system": "epss", "scoring_elements": "0.67263", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00531", "scoring_system": "epss", "scoring_elements": "0.67298", "published_at": "2026-04-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-52434" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/apache/tomcat", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/tomcat" }, { "reference_url": "https://github.com/apache/tomcat/commit/8a83c3c42d20762782678932c14005cd3397a018", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/tomcat/commit/8a83c3c42d20762782678932c14005cd3397a018" }, { "reference_url": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-07-11T14:02:46Z/" } ], "url": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2025/07/10/11", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2025/07/10/11" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382", "reference_id": "2379382", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52434", "reference_id": "CVE-2025-52434", "reference_type": "", "scores": [ { "value": "Important", "scoring_system": "apache_tomcat", "scoring_elements": "" } ], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52434" }, { "reference_url": "https://github.com/advisories/GHSA-4j3c-42xv-3f84", "reference_id": "GHSA-4j3c-42xv-3f84", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-4j3c-42xv-3f84" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:11695", "reference_id": "RHSA-2025:11695", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:11695" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:11696", "reference_id": "RHSA-2025:11696", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:11696" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14177", "reference_id": "RHSA-2025:14177", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14177" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14178", "reference_id": "RHSA-2025:14178", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14178" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14180", "reference_id": "RHSA-2025:14180", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14180" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14181", "reference_id": "RHSA-2025:14181", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14181" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14182", "reference_id": "RHSA-2025:14182", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14182" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14183", "reference_id": "RHSA-2025:14183", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14183" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/809?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.107", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1e6p-cppr-2bh2" }, { "vulnerability": "VCID-8war-4v58-eub2" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@9.0.107" } ], "aliases": [ "CVE-2025-52434", "GHSA-4j3c-42xv-3f84" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9kfe-1esf-uydm" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/4422?format=api", "vulnerability_id": "VCID-fpgj-82wf-ykbw", "summary": "Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Other EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-53506.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-53506.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-53506", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00324", "scoring_system": "epss", "scoring_elements": "0.5542", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00324", "scoring_system": "epss", "scoring_elements": "0.55445", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00429", "scoring_system": "epss", "scoring_elements": "0.62511", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00429", "scoring_system": "epss", "scoring_elements": "0.62492", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00429", "scoring_system": "epss", "scoring_elements": "0.62476", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00429", "scoring_system": "epss", "scoring_elements": "0.62425", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00429", "scoring_system": "epss", "scoring_elements": "0.62478", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00429", "scoring_system": "epss", "scoring_elements": "0.625", "published_at": "2026-04-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-53506" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/apache/tomcat", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/tomcat" }, { "reference_url": "https://github.com/apache/tomcat/commit/2aa6261276ebe50b99276953591e3a2be7898bdb", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/tomcat/commit/2aa6261276ebe50b99276953591e3a2be7898bdb" }, { "reference_url": "https://github.com/apache/tomcat/commit/434772930f362145516dd60681134e7f0cf8115b", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/tomcat/commit/434772930f362145516dd60681134e7f0cf8115b" }, { "reference_url": "https://github.com/apache/tomcat/commit/be8f330f83ceddaf3baeed57522e571572b6b99b", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/tomcat/commit/be8f330f83ceddaf3baeed57522e571572b6b99b" }, { "reference_url": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-07-11T13:46:01Z/" } ], "url": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2025/07/10/13", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2025/07/10/13" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109113", "reference_id": "1109113", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109113" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109114", "reference_id": "1109114", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109114" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386", "reference_id": "2379386", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53506", "reference_id": "CVE-2025-53506", "reference_type": "", "scores": [ { "value": "Important", "scoring_system": "apache_tomcat", "scoring_elements": "" } ], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53506" }, { "reference_url": "https://github.com/advisories/GHSA-25xr-qj8w-c4vf", "reference_id": "GHSA-25xr-qj8w-c4vf", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-25xr-qj8w-c4vf" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:11695", "reference_id": "RHSA-2025:11695", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:11695" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:11696", "reference_id": "RHSA-2025:11696", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:11696" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:11741", "reference_id": "RHSA-2025:11741", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:11741" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:11742", "reference_id": "RHSA-2025:11742", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:11742" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14177", "reference_id": "RHSA-2025:14177", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14177" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14178", "reference_id": "RHSA-2025:14178", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14178" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14179", "reference_id": "RHSA-2025:14179", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14179" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14180", "reference_id": "RHSA-2025:14180", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14180" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14181", "reference_id": "RHSA-2025:14181", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14181" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14182", "reference_id": "RHSA-2025:14182", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14182" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14183", "reference_id": "RHSA-2025:14183", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14183" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/809?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.107", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1e6p-cppr-2bh2" }, { "vulnerability": "VCID-8war-4v58-eub2" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@9.0.107" }, { "url": "http://public2.vulnerablecode.io/api/packages/657?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.43", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1e6p-cppr-2bh2" }, { "vulnerability": "VCID-8war-4v58-eub2" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@10.1.43" }, { "url": "http://public2.vulnerablecode.io/api/packages/589?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@11.0.9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1e6p-cppr-2bh2" }, { "vulnerability": "VCID-8war-4v58-eub2" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@11.0.9" } ], "aliases": [ "CVE-2025-53506", "GHSA-25xr-qj8w-c4vf" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-fpgj-82wf-ykbw" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/4421?format=api", "vulnerability_id": "VCID-k59r-wjt3-wqe5", "summary": "For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-52520.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-52520.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-52520", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00176", "scoring_system": "epss", "scoring_elements": "0.39188", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00176", "scoring_system": "epss", "scoring_elements": "0.3921", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00234", "scoring_system": "epss", "scoring_elements": "0.46247", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00234", "scoring_system": "epss", "scoring_elements": "0.46223", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00234", "scoring_system": "epss", "scoring_elements": "0.46221", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00234", "scoring_system": "epss", "scoring_elements": "0.46165", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00234", "scoring_system": "epss", "scoring_elements": "0.46228", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00234", "scoring_system": "epss", "scoring_elements": "0.46219", "published_at": "2026-04-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-52520" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/apache/tomcat", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/tomcat" }, { "reference_url": "https://github.com/apache/tomcat/commit/927d66fbc294cb65242102b817a45fd80834e040", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/tomcat/commit/927d66fbc294cb65242102b817a45fd80834e040" }, { "reference_url": "https://github.com/apache/tomcat/commit/a51e4bedccfafd35b7cdd0ee3e22267dee9f90db", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/tomcat/commit/a51e4bedccfafd35b7cdd0ee3e22267dee9f90db" }, { "reference_url": "https://github.com/apache/tomcat/commit/fc42bbccb9041fafd194fbfdf3eab1d44cb5c45c", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/tomcat/commit/fc42bbccb9041fafd194fbfdf3eab1d44cb5c45c" }, { "reference_url": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-07-11T14:08:03Z/" } ], "url": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2025/07/10/12", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2025/07/10/12" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109111", "reference_id": "1109111", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109111" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109112", "reference_id": "1109112", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109112" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374", "reference_id": "2379374", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52520", "reference_id": "CVE-2025-52520", "reference_type": "", "scores": [ { "value": "Low", "scoring_system": "apache_tomcat", "scoring_elements": "" } ], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52520" }, { "reference_url": "https://github.com/advisories/GHSA-wr62-c79q-cv37", "reference_id": "GHSA-wr62-c79q-cv37", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-wr62-c79q-cv37" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:11695", "reference_id": "RHSA-2025:11695", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:11695" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:11696", "reference_id": "RHSA-2025:11696", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:11696" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:13685", "reference_id": "RHSA-2025:13685", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:13685" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:13686", "reference_id": "RHSA-2025:13686", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:13686" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14177", "reference_id": "RHSA-2025:14177", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14177" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14178", "reference_id": "RHSA-2025:14178", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14178" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14179", "reference_id": "RHSA-2025:14179", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14179" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14180", "reference_id": "RHSA-2025:14180", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14180" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14181", "reference_id": "RHSA-2025:14181", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14181" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14182", "reference_id": "RHSA-2025:14182", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14182" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14183", "reference_id": "RHSA-2025:14183", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14183" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/809?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.107", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1e6p-cppr-2bh2" }, { "vulnerability": "VCID-8war-4v58-eub2" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@9.0.107" }, { "url": "http://public2.vulnerablecode.io/api/packages/657?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.43", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1e6p-cppr-2bh2" }, { "vulnerability": "VCID-8war-4v58-eub2" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@10.1.43" }, { "url": "http://public2.vulnerablecode.io/api/packages/589?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@11.0.9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1e6p-cppr-2bh2" }, { "vulnerability": "VCID-8war-4v58-eub2" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@11.0.9" } ], "aliases": [ "CVE-2025-52520", "GHSA-wr62-c79q-cv37" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-k59r-wjt3-wqe5" } ], "risk_score": "4.0", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@9.0.107" }