Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-4cag-c4pb-dfaz
Vulnerability ID VCID-4cag-c4pb-dfaz
Aliases CVE-2025-61795
GHSA-hgrr-935x-pq79
Summary Improper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.
Status Published
Exploitability 0.5
Weighted Severity 4.8
Risk 2.4
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-404 Improper Resource Shutdown or Release
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 5.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-61795.json
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2025-61795
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2025-61795
epss 0.00127 https://api.first.org/data/v1/epss?cve=CVE-2025-61795
epss 0.00127 https://api.first.org/data/v1/epss?cve=CVE-2025-61795
epss 0.00127 https://api.first.org/data/v1/epss?cve=CVE-2025-61795
epss 0.00127 https://api.first.org/data/v1/epss?cve=CVE-2025-61795
epss 0.00127 https://api.first.org/data/v1/epss?cve=CVE-2025-61795
epss 0.00138 https://api.first.org/data/v1/epss?cve=CVE-2025-61795
apache_tomcat Low https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61795
cvssv3.1 5.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr LOW https://github.com/advisories/GHSA-hgrr-935x-pq79
cvssv4 2.3 https://github.com/apache/tomcat
generic_textual LOW https://github.com/apache/tomcat
cvssv4 2.3 https://github.com/apache/tomcat/commit/1cdf5f730ede75a0759492f179ac21ca4ff68e06
generic_textual LOW https://github.com/apache/tomcat/commit/1cdf5f730ede75a0759492f179ac21ca4ff68e06
cvssv4 2.3 https://github.com/apache/tomcat/commit/af6e9181620304c0d818121c29c074e1330610d0
generic_textual LOW https://github.com/apache/tomcat/commit/af6e9181620304c0d818121c29c074e1330610d0
cvssv4 2.3 https://github.com/apache/tomcat/commit/afa422bd7ca1eef0f507259c682fd876494d9c3b
generic_textual LOW https://github.com/apache/tomcat/commit/afa422bd7ca1eef0f507259c682fd876494d9c3b
cvssv3.1 5.3 https://lists.apache.org/thread/wm9mx8brmx9g4zpywm06ryrtvd3160pp
cvssv4 2.3 https://lists.apache.org/thread/wm9mx8brmx9g4zpywm06ryrtvd3160pp
generic_textual LOW https://lists.apache.org/thread/wm9mx8brmx9g4zpywm06ryrtvd3160pp
ssvc Track https://lists.apache.org/thread/wm9mx8brmx9g4zpywm06ryrtvd3160pp
cvssv4 2.3 https://nvd.nist.gov/vuln/detail/CVE-2025-61795
generic_textual LOW https://nvd.nist.gov/vuln/detail/CVE-2025-61795
cvssv4 2.3 https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.47
generic_textual LOW https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.47
cvssv4 2.3 https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.12
generic_textual LOW https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.12
cvssv4 2.3 https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.110
generic_textual LOW https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.110
cvssv4 2.3 http://www.openwall.com/lists/oss-security/2025/10/27/6
generic_textual LOW http://www.openwall.com/lists/oss-security/2025/10/27/6
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-61795.json
https://api.first.org/data/v1/epss?cve=CVE-2025-61795
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/apache/tomcat
https://github.com/apache/tomcat/commit/1cdf5f730ede75a0759492f179ac21ca4ff68e06
https://github.com/apache/tomcat/commit/af6e9181620304c0d818121c29c074e1330610d0
https://github.com/apache/tomcat/commit/afa422bd7ca1eef0f507259c682fd876494d9c3b
https://lists.apache.org/thread/wm9mx8brmx9g4zpywm06ryrtvd3160pp
https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.47
https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.12
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.110
http://www.openwall.com/lists/oss-security/2025/10/27/6
1119293 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1119293
1119294 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1119294
2406588 https://bugzilla.redhat.com/show_bug.cgi?id=2406588
CVE-2025-61795 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61795
CVE-2025-61795 https://nvd.nist.gov/vuln/detail/CVE-2025-61795
GHSA-hgrr-935x-pq79 https://github.com/advisories/GHSA-hgrr-935x-pq79
RHSA-2025:19809 https://access.redhat.com/errata/RHSA-2025:19809
RHSA-2025:19810 https://access.redhat.com/errata/RHSA-2025:19810
RHSA-2025:23050 https://access.redhat.com/errata/RHSA-2025:23050
RHSA-2025:23051 https://access.redhat.com/errata/RHSA-2025:23051
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-61795.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U Found at https://github.com/apache/tomcat
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U Found at https://github.com/apache/tomcat/commit/1cdf5f730ede75a0759492f179ac21ca4ff68e06
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U Found at https://github.com/apache/tomcat/commit/af6e9181620304c0d818121c29c074e1330610d0
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U Found at https://github.com/apache/tomcat/commit/afa422bd7ca1eef0f507259c682fd876494d9c3b
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://lists.apache.org/thread/wm9mx8brmx9g4zpywm06ryrtvd3160pp
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U Found at https://lists.apache.org/thread/wm9mx8brmx9g4zpywm06ryrtvd3160pp
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-27T18:48:52Z/ Found at https://lists.apache.org/thread/wm9mx8brmx9g4zpywm06ryrtvd3160pp
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U Found at https://nvd.nist.gov/vuln/detail/CVE-2025-61795
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U Found at https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.47
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U Found at https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.12
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U Found at https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.110
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U Found at http://www.openwall.com/lists/oss-security/2025/10/27/6
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.25512
EPSS Score 0.00089
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:38:03.565171+00:00 Apache Tomcat Importer Import https://tomcat.apache.org/security-11.html 38.0.0