CVE-2025-52520: Apache Tomcat: DoS via integer overflow in multipart file upload
For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.
Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.
Other sources
For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-catalinato a version that resolves this vulnerability.Fixed in 9.0.107 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-catalinato a version that resolves this vulnerability.Fixed in 10.1.43 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-catalinato a version that resolves this vulnerability.Fixed in 11.0.9 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.9 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.43 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.107
Event History
Frequently Asked Questions
What is the severity of CVE-2025-52520?
The severity of CVE-2025-52520 is considered critical due to its potential to cause a denial of service.
How do I fix CVE-2025-52520?
To fix CVE-2025-52520, upgrade Apache Tomcat to the latest version beyond 11.0.8, 10.1.42, or 9.0.106.
Which versions of Apache Tomcat are affected by CVE-2025-52520?
CVE-2025-52520 affects Apache Tomcat versions from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, and from 9.0.0.M1 through 9.0.106.
What type of vulnerability is CVE-2025-52520?
CVE-2025-52520 is an Integer Overflow vulnerability that can lead to a denial of service.
Can CVE-2025-52520 allow an attacker to bypass security limits?
Yes, CVE-2025-52520 can enable an attacker to bypass size limits, leading to a denial of service.