CVE-2025-52434 Security Details

CVE ID

CVE-2025-52434

CWE

CWE-362

CVE Description

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections. This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 9.0.107, which fixes the issue.

Published

Jul 12, 2025

CVSS Score & Severity

8.7High

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS Score

1.205%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/apache/tomcat/util/net/AprEndpoint.stopInternal()V

JVM

Affected Ecosystems

affected

Source

National Vulnerability Database

References

Apache · AnnouncementPROJECT

GitHub · Advisory · GHSA-4j3c-42xv-3f84THIRD_PARTY