CVE-2025-48989: Apache Tomcat DOS Vulnerability

CVE-2025-48989 Overview

CVE-2025-48989 is an Improper Resource Shutdown or Release vulnerability (CWE-404) affecting Apache Tomcat that makes the application server vulnerable to the "made you reset" attack. This denial of service vulnerability allows remote, unauthenticated attackers to disrupt service availability by exploiting improper handling of resource cleanup during connection resets.

The vulnerability stems from how Apache Tomcat manages network resources when connections are abruptly terminated. Attackers can leverage this flaw to exhaust server resources, causing service degradation or complete unavailability for legitimate users.

Critical Impact

Remote unauthenticated attackers can cause denial of service conditions by exploiting improper resource management during connection reset scenarios, affecting service availability for all users.

Affected Products

• Apache Tomcat 11.0.0-M1 through 11.0.9
• Apache Tomcat 10.1.0-M1 through 10.1.43
• Apache Tomcat 9.0.0.M1 through 9.0.107

Discovery Timeline

• 2025-08-13 - CVE-2025-48989 published to NVD
• 2025-11-04 - Last updated in NVD database

Technical Details for CVE-2025-48989

Vulnerability Analysis

The "made you reset" attack exploits a fundamental weakness in how Apache Tomcat handles resource cleanup when network connections are forcibly reset. When a client initiates a connection to Tomcat and then sends a TCP RST (reset) packet, the server must properly release all allocated resources associated with that connection. In vulnerable versions, this resource shutdown process is improperly implemented, allowing attackers to consume server resources without proper cleanup.

This improper resource management can lead to resource exhaustion over time, as the server accumulates orphaned connection resources. The attack requires no authentication and can be executed remotely over the network, making it particularly dangerous for internet-facing Tomcat deployments.

Root Cause

The root cause is classified as CWE-404: Improper Shutdown or Release of Resources. Apache Tomcat fails to properly clean up and release resources when handling connection reset scenarios. This improper resource lifecycle management allows attackers to trigger resource leaks by repeatedly establishing and resetting connections, eventually exhausting available server resources.

Attack Vector

The attack is network-based and requires no user interaction or prior authentication. An attacker can exploit this vulnerability by:

1. Establishing multiple TCP connections to the target Apache Tomcat server
2. Sending partial HTTP requests or initiating connection handshakes
3. Immediately sending TCP RST packets to forcibly terminate the connections
4. Repeating this process to exhaust server resources through accumulated resource leaks

The vulnerability manifests in the connection handling and resource management subsystems of Apache Tomcat. The attack can be executed using basic network tools capable of sending TCP RST packets. For detailed technical analysis, refer to the Apache Security Discussion and the CERT Vulnerability Report #767506.

Detection Methods for CVE-2025-48989

Indicators of Compromise

• Unusual patterns of short-lived TCP connections followed by RST packets from the same source IP addresses
• Increasing memory or connection pool utilization without corresponding legitimate traffic increases
• Server performance degradation or unresponsiveness during periods of abnormal connection reset activity
• Elevated counts of incomplete HTTP requests in Tomcat access logs

Detection Strategies

• Monitor network traffic for patterns of rapid connection establishment followed by immediate TCP RST packets from single or distributed sources
• Implement alerting on resource utilization metrics exceeding baseline thresholds, particularly connection pool exhaustion and memory consumption
• Deploy network-based intrusion detection signatures targeting the "made you reset" attack pattern
• Enable detailed connection logging in Apache Tomcat to track connection lifecycle events

Monitoring Recommendations

• Configure real-time monitoring of Tomcat's thread pool and connection pool utilization metrics
• Set up alerts for sudden spikes in TCP RST packets or abnormal connection termination rates
• Monitor JVM heap usage and garbage collection activity for signs of memory pressure from resource leaks
• Implement network flow analysis to identify potential DoS attack patterns targeting Tomcat instances

How to Mitigate CVE-2025-48989

Immediate Actions Required

• Upgrade Apache Tomcat to patched versions: 11.0.10, 10.1.44, or 9.0.108
• Review and strengthen rate limiting configurations for incoming connections
• Implement network-level protections such as SYN flood protection and connection rate limiting on load balancers
• Consider temporarily increasing resource limits while planning upgrade activities

Patch Information

Apache has released patched versions that address this vulnerability. Users should upgrade to one of the following fixed versions:

• Apache Tomcat 11.0.10 for the 11.x branch
• Apache Tomcat 10.1.44 for the 10.1.x branch
• Apache Tomcat 9.0.108 for the 9.0.x branch

Older, end-of-life versions may also be affected and should be upgraded to supported branches. For official patch information, consult the Apache Security Discussion.

Workarounds

• Deploy a reverse proxy or web application firewall (WAF) in front of Tomcat with connection rate limiting enabled
• Configure network firewalls to limit the rate of new connections from individual IP addresses
• Implement IP-based blocklisting for sources exhibiting attack patterns
• Consider deploying connection pooling at the load balancer level to absorb some attack impact

# Example: Configure connection limits in Apache HTTP Server as reverse proxy
# Add to httpd.conf or virtual host configuration

# Limit connections per IP
<IfModule mod_evasive24.c>
    DOSHashTableSize 3097
    DOSPageCount 2
    DOSSiteCount 50
    DOSPageInterval 1
    DOSSiteInterval 1
    DOSBlockingPeriod 10
</IfModule>

# Rate limiting with mod_ratelimit
<Location "/">
    SetOutputFilter RATE_LIMIT
    SetEnv rate-limit 400
</Location>