Apache Tomcat Security Updates – 14 July 2025

By /
  • 152/2025
  • High

Apache has released security updates to address several vulnerabilities affecting multiple Apache Tomcat versions.

The addressed vulnerabilities could allow the attacker to perform denial of service attacks, bypass security restrictions, or gain access to the affected system by using icacls.exe without specifying a full path.

Sample of the addressed vulnerabilities:

1. Apache Tomcat Side-loading via Tomcat installer for Windows Vulnerability (CVE-2025-49124):

  • CVSS: 8.4
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Consequences: Gain Access

2. Apache Tomcat DOS Due To Overflow In File Upload Limit Vulnerability (CVE-2025-52520):

  • CVSS: 7.5
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Consequences: Denial of Service

The affected products:

  • Apache Tomcat 9.0.0.M1 to 9.0.106.
Vulnerabilities
  • CVE-2025-48976
  • CVE-2025-48988
  • CVE-2025-49124
  • CVE-2025-49125
  • CVE-2025-53506
  • CVE-2025-52520
  • CVE-2025-52434
Mitigations

The enterprise should deploy this patch as soon as the testing phase is
completed.

Apache Tomcat Security Advisory

References

Apache Tomcat Security Advisory