CVE-2025-52434 Apache Tomcat: APR/Native Connector crash leading to DoS
A race condition in the APR/Native connector allows attackers to cause a denial of service via HTTP/2 connection closes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-52434?
CVE-2025-52434 is a high-severity vulnerability in Apache Tomcat, published on 10 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.
This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 9.0.107, which fixes the issue.
Weakness: CWE-362
Which versions are affected by CVE-2025-52434?
9 open source packages ship an affected version, including org.apache.tomcat.embed:tomcat-embed-core, tomcat and org.apache.tomcat:tomcat-coyote. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.5.0 to 8.5.100 | None |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.5.0 to 8.5.100 | None |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 9.0.0.M1 | 9.0.107 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 9.0.0.M1 | 9.0.107 |
tomcat Bitnami | From 9.0.0 | 9.0.107 |
org.apache.tomcat:tomcat-coyote Maven | From 8.5.0 to 8.5.100 | None |
3 more packages
org.apache.tomcat:tomcat-coyote Maven | From 8.5.0 to 8.5.100 | None |
org.apache.tomcat:tomcat-coyote Maven | From 9.0.0.M1 | 9.0.107 |
org.apache.tomcat:tomcat-coyote Maven | From 9.0.0.M1 | 9.0.107 |
Products include Apache Tomcat.
How do I fix CVE-2025-52434?
Upgrade org.apache.tomcat.embed:tomcat-embed-core to 9.0.107 or later.
Is CVE-2025-52434 being exploited?
There is no known exploitation of CVE-2025-52434 in the wild and no public exploit code.
Other vulnerabilities in Apache Tomcat
Sources
Also known as BIT-tomcat-2025-52434, CLSA-2026-1771891820, CLSA-2026-1771978232, CLSA-2026-1779805268, CLSA-2026-1780274968, DEBIAN-CVE-2025-52434 and 4 more.