[<prev] [next>] [day] [month] [year] [list]
Message-ID: <26616a8a-c74b-4262-9c91-4353a50c6d4f@apache.org>
Date: Thu, 10 Jul 2025 20:04:37 +0100
From: Mark Thomas <markt@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-52434: Apache Tomcat: APR/Native Connector crash leading to
DoS
Severity: important
Affected versions:
- Apache Tomcat 9.0.0.M1 through 9.0.106
Description:
Concurrent Execution using Shared Resource with Improper Synchronization
('Race Condition') vulnerability in Apache Tomcat when using the
APR/Native connector. This was particularly noticeable with client
initiated closes of HTTP/2 connections.
This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.
Users are recommended to upgrade to version 9.0.107, which fixes the issue.
Credit:
Nacl (finder)
12SqweR (finder)
WHOAMI (finder)
yyzmoon (finder)
References:
https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030
https://tomcat.apache.org/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
