CVE-2025-52434: Apache Tomcat: APR/Native Connector crash leading to DoS
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.
This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.
Users are recommended to upgrade to version 9.0.107, which fixes the issue.
Other sources
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.
This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 9.0.107, which fixes the issue.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-utilto a version that resolves this vulnerability.Fixed in 9.0.107 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.9 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.43 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.107
Event History
Frequently Asked Questions
What is the severity of CVE-2025-52434?
CVE-2025-52434 has a medium severity rating due to the potential for a race condition flaw.
How do I fix CVE-2025-52434?
To fix CVE-2025-52434, update your Apache Tomcat instance to version 9.0.106 or later.
What products are affected by CVE-2025-52434?
CVE-2025-52434 affects Apache Tomcat versions from 9.0.0.M1 to 9.0.106.
What type of vulnerability is CVE-2025-52434?
CVE-2025-52434 is a race condition vulnerability that arises from improper synchronization in Apache Tomcat's APR/Native connector.
How can CVE-2025-52434 impact my application?
CVE-2025-52434 can allow attackers to exploit the race condition, potentially impacting the reliability and security of web applications using affected Tomcat versions.