CVE-2025-53506

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Tomcat	>= 11.0.0-M1, <= 11.0.8; >= 10.1.0-M1, <= 10.1.42; >= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100

References

https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0Issue Tracking, Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/07/10/13
https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html

Timeline

Published: Jul 10, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-535077.1Multiple products provided by iND Co.,Ltd contain an insecure storage of sensitive information vulnerability. If exploited, configuration in CVE-2025-535088.6Multiple products provided by iND Co.,Ltd contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be execut CVE-2025-535096.5A vulnerability exists in Advantech iView that allows for argument injection in the NetworkServlet.restoreDatabase(). This issue requires CVE-2025-53516.5A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptograph CVE-2025-535108.8A memory corruption vulnerability exists in the PSD Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. When loading a s CVE-2025-535119.8A heap-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch CVE-2025-535126.5The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that cou CVE-2025-535136.5The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upl CVE-2025-535145.9Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant CVE-2025-535158.8A vulnerability exists in Advantech iView that allows for SQL injection and remote code execution through NetworkServlet.archiveTrap(). Thi CVE-2025-535166.1A reflected cross-site scripting (xss) vulnerability exists in the downloadZip functionality of MedDream PACS Premium 7.3.6.870. A specially CVE-2025-535189.8An integer overflow vulnerability exists in the ABF parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa)