Improper Resource Shutdown Vulnerability in Apache Tomcat by Apache

CVE-2025-61795

What is CVE-2025-61795?

An improper resource shutdown vulnerability exists in Apache Tomcat that may compromise system stability. When an error occurs during a multipart upload—such as exceeding limits—temporary copies of the uploaded files are not immediately deleted. This oversight means that if the Java Virtual Machine (JVM) settings, application memory usage, and load conditions are unfavorable, the space allocated for these temporary files might get filled faster than the garbage collection process can clear it, potentially resulting in a Denial of Service (DoS) situation. To mitigate this issue, users should upgrade to version 11.0.12 or later, 10.1.47 or later, or 9.0.110 or later.

References