CVE-2025-48989
Published: 13 August 2025
Summary
CVE-2025-48989 is a high-severity Improper Resource Shutdown or Release (CWE-404) vulnerability in Apache Tomcat. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 13.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-48989 is an Improper Resource Shutdown or Release vulnerability, tracked as CWE-404, that leaves Apache Tomcat exposed to the "made you reset" attack. It affects Tomcat releases 11.0.0-M1 through 11.0.9, 10.1.0-M1 through 10.1.43, and 9.0.0.M1 through 9.0.107, with older end-of-life versions also potentially impacted. The flaw carries a CVSS 3.1 base score of 7.5, reflecting network-accessible exploitation that can produce high impact to availability without requiring authentication or user interaction.
An unauthenticated remote attacker can send crafted requests that trigger improper connection or resource release, resulting in denial of service against the Tomcat instance. Because the attack requires no privileges and can be launched over the network with low complexity, it is feasible from any internet-facing position.
Apache Tomcat project advisories and coordinated disclosures, including the Apache announcement and the CERT/CC entry, recommend immediate upgrade to the fixed releases 11.0.10, 10.1.44, or 9.0.108. Siemens and other downstream vendors have mirrored these upgrade instructions in their own security bulletins.
EPSS remains low and unchanged at 0.0282, indicating no material increase in observed exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-24559
Vulnerability details
Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may…
more
also be affected. Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Contingency plan updates incorporate proper resource shutdown and release steps, preventing attackers from leveraging incomplete cleanup during recovery scenarios.
Mandates explicit shutdown of the network connection at session conclusion, directly addressing improper resource release.
Requires proper shutdown/release procedures that include overwriting or isolating data to block unintended transfer via reused system objects.
Procedures can mandate orderly shutdown or release of resources when failures occur, preventing improper resource handling after a fault.