CVE-2025-48989

CVSS 3.1: 7.5 high
EPSS: 4%p89
Published: Aug 13, 2025 · Aug 13, 2025
Modified: Jun 17, 2026

Analyze CVE-2025-48989 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected. Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.

Vendors: apache

Products: tomcat

Weakness: CWE-404

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (3.5%)

In the news

1 story

New HTTP/2 'MadeYouReset' Vulnerability Enables Large

The Hacker NewsAug 22, 16:45 UTC · Aug 22, 2025VulnerabilityCVE-2025-8671 CVE-2025-48989 CVE-2025-54500+42 · 1 read