CVE-2025-48989

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.

Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-404

Affected software

No affected versions have been published.

Timeline

Published
Aug 13, 2025
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-48999.8A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been rated as critical. This issue affects some unknown procesCVE-2025-489908.6NeKernal is a free and open-source operating system stack. Version 0.0.2 has a 1-byte heap overflow in `rt_copy_memory`, which unconditionalCVE-2025-489914.3Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a vulnerability preseCVE-2025-489924.8Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a stored and blindCVE-2025-489936.1Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a malicious JavaScCVE-2025-489946.9SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned CVE-2025-489956.9SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned CVE-2025-489965.3HAX open-apis provides microservice apis for HAX webcomponents repo that are shared infrastructure calls. An unauthenticated information disCVE-2025-489978.7Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and priorCVE-2025-489988.8DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, a bypass of the patch for CVE-2025-27CVE-2025-489998.8DataEase is an open source business intelligence and data visualization tool. A bypass of CVE-2025-46566's patch exists in versions prior toCVE-2025-49009.8A vulnerability classified as critical has been found in Campcodes Sales and Inventory System 1.0. Affected is an unknown function of the fi
CVE-2025-48989: High severity, CVSS 7.5 | Vulnix