Intel

CVE-2025-5115

Tomcat: Uncontrolled Resource Consumption (CVE-2025-5115)

highEPSS 3.5%

Description

In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state, therefore forcing the server to consume resources such as CPU and memory. For example, a client can open a stream and then send WINDOW_UPDATE frames with window size increment of 0, which is illegal. Per specification https://www.rfc-editor.org/rfc/rfc9113.html#name-window_update , the server should send a RST_STREAM frame. The client can now open another stream and send another bad WINDOW_UPDATE, therefore causing the server to consume more resources than necessary, as this case does not exceed the max number of concurrent streams, yet the client is able to create an enormous amount of streams in a short period of time. The attack can be performed with other conditions (for example, a DATA frame for a closed stream) that cause the server to send a RST_STREAM frame. Links: * https://github.com/jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h

Source: BSI_CSAFBSIBSI_CSAFBSICVELISTV5OSV

Metrics

Severity
high
Priority score
102.82
KEV status
—
Exploit maturity
no public PoC known
XIEM Effective CVSS
7.7
Source: cna-v4
CVSS v3
—
CVSS v4
7.7
EPSS percentile
88.3 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
3.5 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2025-08-20 19:07 UTC
CWE
CWE-400

Weakness classes (CWE)

  • CWE-400Class

    Uncontrolled Resource Consumption

    The product does not properly control the allocation and maintenance of a limited resource.

    cwe.mitre.org →

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • Apache

    Tomcat< 10.1.44

    fixed in 10.1.44

  • Apache

    Tomcat< 11.0.10

    fixed in 11.0.10

  • Apache

    Tomcat< 9.0.108

    fixed in 9.0.108

  • Atlassian

    Bamboo< 10.2.8

    fixed in 10.2.8

  • Atlassian

    Bamboo< 11.0.5

    fixed in 11.0.5

  • Atlassian

    Bamboo< 9.6.17

    fixed in 9.6.17

  • Atlassian

    Bitbucket< 10.0.2

    fixed in 10.0.2

  • Atlassian

    Bitbucket<8.19.25 (LTS)

  • Atlassian

    Bitbucket<9.4.13 (LTS)

  • Atlassian

    Jira< 10.3.12

    fixed in 10.3.12

  • Atlassian

    Jira< 11.1.1

    fixed in 11.1.1

  • Atlassian

    Jira< 9.12.28

    fixed in 9.12.28

  • Dell

    NetWorkerManagement Console <19.13.0.2

  • Dell

    NetWorkerManagement Web UI <19.13.0.2

  • Dell

    Secure Connect Gateway< 5.34.00.16

    fixed in 5.34.00.16

  • Dell

    Secure Connect GatewayAppliance <5.32.00.18

  • Eclipse

    Jetty< 10.0.26

    fixed in 10.0.26

  • Eclipse

    Jetty< 11.0.26

    fixed in 11.0.26

  • Eclipse

    Jetty< 12.0.25

    fixed in 12.0.25

  • Eclipse

    Jetty< 12.1.0.beta3

    fixed in 12.1.0.beta3

  • Eclipse

    Jetty< 9.4.58

    fixed in 9.4.58

  • HCL

    Commerce< 25.09.17.0

    fixed in 25.09.17.0

  • IBM

    Integration Bus10.1.0.0-10.1.0.6

  • IBM

    Storage Scale< 5.2.3.4

    fixed in 5.2.3.4

References & sources

IDCVE-2025-5115