Listen to this Post
Apache Tomcat’s Improper Resource Shutdown or Release vulnerability (CVE-2025-XXXXX) allows attackers to trigger a denial-of-service (DoS) condition via a “made you reset” attack. The flaw occurs due to improper handling of connection closures during HTTP/2 stream termination, leading to resource exhaustion. When malicious clients abruptly terminate connections, Tomcat fails to properly release associated resources, causing thread pool saturation and degraded performance. The vulnerability affects HTTP/2-enabled servers running Tomcat 9.0.0.M1 to 9.0.107, 10.1.0-M1 to 10.1.43, and 11.0.0-M1 to 11.0.9. Attackers exploit this by sending repeated reset frames (RST_STREAM), forcing the server to retain orphaned threads and buffers.
DailyCVE Form:
Platform: Apache Tomcat
Version: 9.0.0-9.0.107
Vulnerability: Resource exhaustion
Severity: High
Date: Aug 13, 2025
Prediction: Patch by Sep 2025
What Undercode Say:
Check Tomcat version: ./catalina.sh version Monitor thread usage: jstack <tomcat_pid> | grep "http-nio" Mitigation (pre-patch): server.tomcat.h2.enabled=false
How Exploit:
1. Craft HTTP/2 RST_STREAM floods.
2. Target Tomcat with Keep-Alive enabled.
3. Observe thread pool starvation.
Protection from this CVE:
- Upgrade to 9.0.108/10.1.44/11.0.10.
- Disable HTTP/2 if unused.
- Limit max concurrent streams.
Impact:
- Service degradation.
- DoS via resource exhaustion.
- Memory leaks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
