CVE-2025-53506

🗓️ 10 Jul 2025 19:14:23Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 121 Views

Apache Tomcat DoS vulnerability due to excessive h2 streams affects versions up to 11.0.8, 10.1.42, 9.0.106.

Reporter	Title	Published	Views	Family All 245
IBM Security Bulletins	Security Bulletin: IBM Integration Bus for z/OS is vulnerable to multiple vulnerabilities due to Apache Tomcat( CVE-2025-53506, CVE-2025-52434 and CVE-2025-52520 )	20 Aug 202506:45	–	ibm
IBM Security Bulletins	Security Bulletin: Common Vulnerabilities Addressed in Cloudera Data Platform Private Cloud Base with IBM 7.3.1	15 May 202615:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in tomcat-embed-core-9.0.106.jar	6 Oct 202519:08	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of Apache Tomcat, IBM ApplinX is vulnerable to multiple vulnerabilities (CVE-2025-52520, CVE-2025-53506 and CVE-2025-52434).	7 Oct 202514:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption in Apache Tomcat [CVE-2025-53506]	31 Oct 202518:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multiple vulnerabilities	6 Mar 202616:04	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions.	12 Aug 202509:33	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM webMethods BPM.	11 Nov 202513:35	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Tomcat Server (CVE-2025-52434, CVE-2025-48989, CVE-2025-52520, CVE-2025-53506, CVE-2025-55668, CVE-2025-49125, CVE-2025-48988, CVE-2025-46701, CVE-2025-31651, CVE-2025-31650) affect Power HMC.	20 Nov 202506:10	–	ibm
Tenable Nessus	Amazon Linux 2023 : tomcat10, tomcat10-admin-webapps, tomcat10-el-5.0-api (ALAS2023-2025-1093)	4 Aug 202500:00	–	nessus

NVD

Vulners

Node

apache tomcatRange9.0.0–9.0.106

apache tomcatRange10.1.0–10.1.42

apache tomcatRange11.0.0–11.0.8

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Tomcat",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "11.0.8",
        "status": "affected",
        "version": "11.0.0-M1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "10.1.42",
        "status": "affected",
        "version": "10.1.0-M1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "9.0.106",
        "status": "affected",
        "version": "9.0.0.M1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "8.5.100",
        "status": "affected",
        "version": "8.5.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "10.0.27",
        "status": "unknown",
        "version": "10.0.0-M1",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0
openwall	www.openwall.com/lists/oss-security/2025/07/10/13
lists	www.lists.debian.org/debian-lts-announce/2025/07/msg00009.html

04 Nov 2025 22:16Current

7.8High risk

Vulners AI Score7.8

CVSS 3.17.5

EPSS0.01247

SSVC

CWE-400