Listen to this Post
The vulnerability, CVE-2025-XXXXX, is an improper resource shutdown issue in Apache Tomcat’s multipart request handling. When a file upload is processed as part of a multipart/form-data request, Tomcat creates temporary files on disk for the uploaded parts. If an error occurs during this processing—such as exceeding size limits, an I/O error, or an invalid request—the servlet container correctly terminates the request for the client. However, the underlying code fails to invoke the cleanup mechanism that immediately deletes the associated temporary files from the filesystem. These orphaned files remain on disk until they are eventually deleted by Tomcat’s background garbage collection thread. Under conditions of high application load with frequent file upload errors, the rate of temporary file creation can exceed the garbage collector’s cleanup rate. This leads to a gradual accumulation of files, consuming all available disk space and resulting in a denial-of-service (DoS) condition for the entire application, as Tomcat can no longer write any data.
Platform: Apache Tomcat
Version: 8.5.60-100, 9.0.0-109
Vulnerability: Resource Exhaustion DoS
Severity: Low
date: 2025-10-27
Prediction: Patch available
What Undercode Say:
`ls -la /tmp/tomcat./work/`
`df -h`
`find /path/to/tomcat/work -name “.tmp” -type f`
`curl -F “[email protected]” http://host/upload`
How Exploit:
Send malformed/massive multipart requests causing upload errors to exhaust disk space.
Protection from this CVE
Upgrade to Tomcat versions 11.0.12, 10.1.47, or 9.0.110. Monitor disk usage in /tmp and Tomcat work directories. Implement reverse proxy file size limits.
Impact:
Local disk exhaustion leading to application Denial-of-Service.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
