Staging Environment: Content and features may be unstable or change without notice.
Advisory details: gitlab / maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2025-61795
Advisory ID gitlab/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2025-61795
Aliases CVE-2025-61795
GHSA-hgrr-935x-pq79
Summary Apache Tomcat Vulnerable to Improper Resource Shutdown or Release If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (3)
CWE-404 Improper Resource Shutdown or Release
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2025-61795.yml
Reference id Reference type URL
https://github.com/apache/tomcat/commit/1cdf5f730ede75a0759492f179ac21ca4ff68e06
https://github.com/apache/tomcat/commit/af6e9181620304c0d818121c29c074e1330610d0
https://github.com/apache/tomcat/commit/afa422bd7ca1eef0f507259c682fd876494d9c3b
https://lists.apache.org/thread/wm9mx8brmx9g4zpywm06ryrtvd3160pp
https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.47
https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.12
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.110
CVE-2025-61795 https://nvd.nist.gov/vuln/detail/CVE-2025-61795
GHSA-hgrr-935x-pq79 https://github.com/advisories/GHSA-hgrr-935x-pq79
ssa-032379.html Other https://cert-portal.siemens.com/productcert/html/ssa-032379.html
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2025-61795.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-27T18:48:52Z/

Decision: Track

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2025/61xxx/CVE-2025-61795.json

Source Advisory: vulnrichment/CVE-2025-61795

View SSVC decision tree 
[{'Exploitation': 'none'},
 {'Automatable': 'no'},
 {'Technical Impact': 'partial'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]