CVE-2025-61795 (GCVE-0-2025-61795)

Vulnerability from cvelistv5 – Published: 2025-10-27 17:30 – Updated: 2026-05-12 12:08
VLAI
Title
Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS
Summary
Improper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.
Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-27 18:48 UTC
CWE
  • CWE-404 - Improper Resource Shutdown or Release
Assigner
apache CNA under the mitre root
CNA scorecard B 76/100 over 940 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Apache Software Foundation Apache Tomcat Affected: 11.0.0-M1 , ≤ 11.0.11 (semver)
Affected: 10.1.0-M1 , ≤ 10.1.46 (semver)
Affected: 9.0.0.M1 , ≤ 9.0.109 (semver)
Affected: 8.5.0 , ≤ 8.5.100 (semver)
Unknown: 3 , < 8.5.0 (semver)
Unknown: 10.0.0-M1 , ≤ 10.0.27 (semver)
guessed Create a notification for this product.
Siemens SIMATIC CN 4100 Affected: 0 , < V5.0 (custom)
guessed Create a notification for this product.
Credits
sw0rd1ight (https://github.com/sw0rd1ight)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-61795",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-27T18:48:52.755946Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-27T18:48:55.273Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:14:10.512Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/10/27/6"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:08:33.715Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.11",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.46",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.109",
              "status": "affected",
              "version": "9.0.0.M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.0",
              "status": "unknown",
              "version": "3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.0.27",
              "status": "unknown",
              "version": "10.0.0-M1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "sw0rd1ight (https://github.com/sw0rd1ight)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Resource Shutdown or Release vulnerability in Apache Tomcat.\u003c/p\u003e\u003cdiv\u003e\u003cp\u003eIf an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.\u003c/p\u003e\u003c/div\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109.\u003c/p\u003eThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.\u003cbr\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Improper Resource Shutdown or Release vulnerability in Apache Tomcat.\n\nIf an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.\nUsers are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-404",
              "description": "CWE-404 Improper Resource Shutdown or Release",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-29T11:37:45.872Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/wm9mx8brmx9g4zpywm06ryrtvd3160pp"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-61795",
    "datePublished": "2025-10-27T17:30:28.334Z",
    "dateReserved": "2025-10-01T09:20:53.155Z",
    "dateUpdated": "2026-05-12T12:08:33.715Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-61795",
      "date": "2026-10-09",
      "epss": "0.01249",
      "percentile": "0.68505"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Apache Tomcat",
                "vendor": "Apache Software Foundation",
                "versions": [
                  {
                    "lessThanOrEqual": "11.0.11",
                    "status": "affected",
                    "version": "11.0.0-M1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "10.1.46",
                    "status": "affected",
                    "version": "10.1.0-M1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "9.0.109",
                    "status": "affected",
                    "version": "9.0.0.M1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.5.100",
                    "status": "affected",
                    "version": "8.5.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "8.5.0",
                    "status": "unknown",
                    "version": "3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "10.0.27",
                    "status": "unknown",
                    "version": "10.0.0-M1",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "security@apache.org"
          },
          {
            "affectedData": [
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC CN 4100",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V5.0",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FF43D0D7-FBF3-4D7A-84C4-47B65A75A524",
                    "versionEndIncluding": "8.5.100",
                    "versionStartIncluding": "8.5.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CA30BB96-A72D-42BA-9058-7ABBEB5560E9",
                    "versionEndExcluding": "9.0.110",
                    "versionStartIncluding": "9.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B30CA0D9-834D-4044-B03B-7E6E60A4B0E6",
                    "versionEndExcluding": "10.0.27",
                    "versionStartIncluding": "10.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E433C62E-73C1-443F-9C89-D0C2EDF13F99",
                    "versionEndExcluding": "10.1.47",
                    "versionStartIncluding": "10.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "03C75BFF-9137-45AF-B5F4-99E2CBF1D3F4",
                    "versionEndExcluding": "11.0.12",
                    "versionStartIncluding": "11.0.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Improper Resource Shutdown or Release vulnerability in Apache Tomcat.\n\nIf an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.\nUsers are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue."
          },
          {
            "lang": "es",
            "value": "Vulnerabilidad de cierre o liberaci\u00f3n inadecuada de recursos en Apache Tomcat.\n\nSi ocurr\u00eda un error (incluido el exceder l\u00edmites) durante el procesamiento de una carga multipart, las copias temporales de las partes cargadas escritas en disco no se limpiaban inmediatamente, sino que se dejaban para que el proceso de recolecci\u00f3n de basura las eliminara. Dependiendo de la configuraci\u00f3n de la JVM, el uso de memoria de la aplicaci\u00f3n y la carga de la aplicaci\u00f3n, era posible que el espacio para las copias temporales de las partes cargadas se llenara m\u00e1s r\u00e1pido de lo que el GC lo liberaba, lo que llevaba a un DoS.\n\nEste problema afecta a Apache Tomcat: desde 11.0.0-M1 hasta 11.0.11, desde 10.1.0-M1 hasta 10.1.46, desde 9.0.0.M1 hasta 9.0.109.\n\nLas siguientes versiones estaban al final de su vida \u00fatil (EOL) en el momento en que se cre\u00f3 el CVE, pero se sabe que est\u00e1n afectadas: 8.5.0 hasta 8.5.100. Otras versiones m\u00e1s antiguas y EOL tambi\u00e9n pueden estar afectadas.\nSe recomienda a los usuarios actualizar a la versi\u00f3n 11.0.12 o posterior, 10.1.47 o posterior o 9.0.110 o posterior, lo que soluciona el problema."
          }
        ],
        "id": "CVE-2025-61795",
        "lastModified": "2026-10-08T11:10:00.250",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-61795",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-27T18:48:52.755946Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-10-27T18:15:44.200",
        "references": [
          {
            "source": "security@apache.org",
            "tags": [
              "Mailing List",
              "Vendor Advisory"
            ],
            "url": "https://lists.apache.org/thread/wm9mx8brmx9g4zpywm06ryrtvd3160pp"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2025/10/27/6"
          },
          {
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "sourceIdentifier": "security@apache.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-404"
              }
            ],
            "source": "security@apache.org",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-09T01:23:44+00:00",
      "cve": "CVE-2025-61795",
      "id": "CVE-2025-61795",
      "initial_release_date": "2025-10-27T17:30:28.334000+00:00",
      "product_status:fixed": "171",
      "product_status:known_affected": "101",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61795.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-28T16:51:10Z",
      "cve": "CVE-2025-61795",
      "id": "CVE-2025-61795",
      "initial_release_date": "2025-10-29T00:23:38Z",
      "product_status:known_affected": "551",
      "product_status:recommended": "501",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-61795",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-61795.json",
      "version": "37"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-04T21:14:10.512Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "http://www.openwall.com/lists/oss-security/2025/10/27/6"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "HIGH",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "HIGH",
                  "baseScore": 5.3,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-61795",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-27T18:48:52.755946Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-27T18:48:43.958Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Apache Tomcat",
              "vendor": "Apache Software Foundation",
              "versions": [
                {
                  "lessThanOrEqual": "11.0.11",
                  "status": "affected",
                  "version": "11.0.0-M1",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "10.1.46",
                  "status": "affected",
                  "version": "10.1.0-M1",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "9.0.109",
                  "status": "affected",
                  "version": "9.0.0.M1",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "8.5.100",
                  "status": "affected",
                  "version": "8.5.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "8.5.0",
                  "status": "unknown",
                  "version": "3",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "10.0.27",
                  "status": "unknown",
                  "version": "10.0.0-M1",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "sw0rd1ight (https://github.com/sw0rd1ight)"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eImproper Resource Shutdown or Release vulnerability in Apache Tomcat.\u003c/p\u003e\u003cdiv\u003e\u003cp\u003eIf an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.\u003c/p\u003e\u003c/div\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109.\u003c/p\u003eThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.\u003cbr\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.\u003c/p\u003e"
                }
              ],
              "value": "Improper Resource Shutdown or Release vulnerability in Apache Tomcat.\n\nIf an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.\nUsers are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "text": "low"
                },
                "type": "Textual description of severity"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-404",
                  "description": "CWE-404 Improper Resource Shutdown or Release",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-10-29T11:37:45.872Z",
            "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
            "shortName": "apache"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://lists.apache.org/thread/wm9mx8brmx9g4zpywm06ryrtvd3160pp"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS",
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "assignerShortName": "apache",
        "cveId": "CVE-2025-61795",
        "datePublished": "2025-10-27T17:30:28.334Z",
        "dateReserved": "2025-10-01T09:20:53.155Z",
        "dateUpdated": "2025-11-04T21:14:10.512Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.