CVE-2025-61795

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 8.5.0 through 8.5.100 Apache Tomcat versions 9.0.0.M1 through 9.0.109 Apache Tomcat versions 10.1.0-M1 through 10.1.46 Apache Tomcat versions 11.0.0-M1 through 11.0.11

Description An improper resource shutdown or release issue exists in Apache Tomcat. During a multipart upload, if an error occurs (including exceeding limits), temporary copies of the uploaded parts written to disc were not immediately cleaned up. These copies were left for garbage collection. Depending on JVM settings, application memory usage, and application load, the space for these temporary copies could be filled faster than garbage collection could clear it, potentially leading to a denial-of-service (DoS) condition.

Recommendations Upgrade to Apache Tomcat version 11.0.12 or later. Upgrade to Apache Tomcat version 10.1.47 or later. Upgrade to Apache Tomcat version 9.0.110 or later.