CVE-2025-48989

CVE Details

Release Date:	2025-08-13
Impact:	Important	What is this?

Description

Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected. Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.

See more information about CVE-2025-48989 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	7.5
Vector String:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Version:	3.1
Attack Vector:	Network
Attack Complexity:	Low
Privileges Required:	None
User Interaction:	None
Scope:	Unchanged
Confidentiality Impact:	None
Integrity Impact:	None
Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 10 (tomcat)	ELSA-2025-14179	2025-08-22
Oracle Linux version 10 (tomcat9)	ELSA-2025-14178	2025-08-21
Oracle Linux version 8 (tomcat)	ELSA-2025-14177	2025-08-20
Oracle Linux version 9 (tomcat)	ELSA-2025-14181	2025-08-20