Search for vulnerabilities
Vulnerability details: VCID-2c1v-7he2-4fe5
Vulnerability ID VCID-2c1v-7he2-4fe5
Aliases CVE-2025-48989
GHSA-gqp3-2cvr-x8m3
Summary Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected. Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-404 Improper Resource Shutdown or Release
CWE-400 Uncontrolled Resource Consumption
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-48989.json
epss 0.0004 https://api.first.org/data/v1/epss?cve=CVE-2025-48989
epss 0.0004 https://api.first.org/data/v1/epss?cve=CVE-2025-48989
epss 0.0004 https://api.first.org/data/v1/epss?cve=CVE-2025-48989
epss 0.0004 https://api.first.org/data/v1/epss?cve=CVE-2025-48989
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2025-48989
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2025-48989
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2025-48989
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2025-48989
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2025-48989
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2025-48989
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2025-48989
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2025-48989
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2025-48989
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2025-48989
apache_tomcat Important https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48989
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-gqp3-2cvr-x8m3
cvssv3.1 7.5 https://github.com/apache/tomcat
generic_textual HIGH https://github.com/apache/tomcat
cvssv3.1 7.5 https://github.com/apache/tomcat/commit/73c04a10395774bda71a0b37802cf983662ce255
generic_textual HIGH https://github.com/apache/tomcat/commit/73c04a10395774bda71a0b37802cf983662ce255
cvssv3.1 7.5 https://github.com/apache/tomcat/commit/f362c8eb3b8ec5b7f312f7f5610731c0fb299a06
generic_textual HIGH https://github.com/apache/tomcat/commit/f362c8eb3b8ec5b7f312f7f5610731c0fb299a06
cvssv3.1 7.5 https://github.com/apache/tomcat/commit/f36b8a4eea4ce8a0bc035079e1d259d29f5eb7bf
generic_textual HIGH https://github.com/apache/tomcat/commit/f36b8a4eea4ce8a0bc035079e1d259d29f5eb7bf
cvssv3.1 7.5 https://lists.apache.org/thread/9ydfg0xr0tchmglcprhxgwhj0hfwxlyf
generic_textual HIGH https://lists.apache.org/thread/9ydfg0xr0tchmglcprhxgwhj0hfwxlyf
ssvc Track https://lists.apache.org/thread/9ydfg0xr0tchmglcprhxgwhj0hfwxlyf
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2025-48989
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2025-48989
cvssv3.1 7.5 https://tomcat.apache.org/security-10.html
generic_textual HIGH https://tomcat.apache.org/security-10.html
cvssv3.1 7.5 https://tomcat.apache.org/security-11.html
generic_textual HIGH https://tomcat.apache.org/security-11.html
cvssv3.1 7.5 https://tomcat.apache.org/security-9.html
generic_textual HIGH https://tomcat.apache.org/security-9.html
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-48989.json
https://api.first.org/data/v1/epss?cve=CVE-2025-48989
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/apache/tomcat
https://github.com/apache/tomcat/commit/73c04a10395774bda71a0b37802cf983662ce255
https://github.com/apache/tomcat/commit/f362c8eb3b8ec5b7f312f7f5610731c0fb299a06
https://github.com/apache/tomcat/commit/f36b8a4eea4ce8a0bc035079e1d259d29f5eb7bf
https://nvd.nist.gov/vuln/detail/CVE-2025-48989
https://tomcat.apache.org/security-10.html
https://tomcat.apache.org/security-11.html
https://tomcat.apache.org/security-9.html
1111096 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111096
2373309 https://bugzilla.redhat.com/show_bug.cgi?id=2373309
9ydfg0xr0tchmglcprhxgwhj0hfwxlyf https://lists.apache.org/thread/9ydfg0xr0tchmglcprhxgwhj0hfwxlyf
CVE-2025-48989 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48989
GHSA-gqp3-2cvr-x8m3 https://github.com/advisories/GHSA-gqp3-2cvr-x8m3
RHSA-2025:13685 https://access.redhat.com/errata/RHSA-2025:13685
RHSA-2025:13686 https://access.redhat.com/errata/RHSA-2025:13686
RHSA-2025:14177 https://access.redhat.com/errata/RHSA-2025:14177
RHSA-2025:14178 https://access.redhat.com/errata/RHSA-2025:14178
RHSA-2025:14179 https://access.redhat.com/errata/RHSA-2025:14179
RHSA-2025:14180 https://access.redhat.com/errata/RHSA-2025:14180
RHSA-2025:14181 https://access.redhat.com/errata/RHSA-2025:14181
RHSA-2025:14182 https://access.redhat.com/errata/RHSA-2025:14182
RHSA-2025:14183 https://access.redhat.com/errata/RHSA-2025:14183
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-48989.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/apache/tomcat
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/apache/tomcat/commit/73c04a10395774bda71a0b37802cf983662ce255
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/apache/tomcat/commit/f362c8eb3b8ec5b7f312f7f5610731c0fb299a06
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/apache/tomcat/commit/f36b8a4eea4ce8a0bc035079e1d259d29f5eb7bf
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.apache.org/thread/9ydfg0xr0tchmglcprhxgwhj0hfwxlyf
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-08-13T18:37:15Z/ Found at https://lists.apache.org/thread/9ydfg0xr0tchmglcprhxgwhj0hfwxlyf
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2025-48989
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://tomcat.apache.org/security-10.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://tomcat.apache.org/security-11.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://tomcat.apache.org/security-9.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.10894
EPSS Score 0.0004
Published At Aug. 14, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-08-01T08:09:51.736618+00:00 SUSE Severity Score Importer Import https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml 37.0.0