ByteOS Network

NVD Vulnerability Details :

CVE-2025-53506

Modified

Source-security@apache.org

Published At-10 Jul, 2025 | 20:15

Updated At-08 Aug, 2025 | 13:15

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CPE Matches

The Apache Software Foundation

>>tomcat>>Versions from 9.0.0(inclusive) to 9.0.106(inclusive)

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

The Apache Software Foundation

>>tomcat>>Versions from 10.1.0(inclusive) to 10.1.42(inclusive)

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

The Apache Software Foundation

>>tomcat>>Versions from 11.0.0(inclusive) to 11.0.8(inclusive)

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-400	Secondary	security@apache.org

References

Hyperlink	Source	Resource
https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0	security@apache.org	Issue Tracking Mailing List Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History