Apache Tomcat 9.0.0.M1 < 9.0.107 multiple vulnerabilities

Tenable plugin 241680 bundles three CVEs fixed in Apache Tomcat 9.0.107, all affecting versions 9.0.0.M1 through 9.0.106. CVE-2025-52520 is an integer overflow in the postSize accumulator during multipart file uploads — the int wraps negative, bypassing maxPostSize and letting an attacker exhaust disk or memory. CVE-2025-52434 is a race condition in the APR/Native connector during HTTP/2 connection teardown that can crash the JVM. CVE-2025-53506 exploits the gap before a client ACKs the server's SETTINGS frame to open unlimited HTTP/2 streams, exhausting threads and memory. All three are availability-only — zero impact on confidentiality or integrity.

The vendor CVSS of 7.5 HIGH is technically correct for a network-reachable, unauthenticated DoS with no user interaction. But it overstates real-world urgency. CVE-2025-52434 only fires if you run the APR/Native connector — most production Tomcat deployments use the default NIO connector and are immune. The other two require HTTP/2 to be enabled. None of these bugs chain to code execution, privilege escalation, or data exfiltration. Tenable's own VPR score of 3.0 (23rd percentile) already signals this is low-priority, and no active exploitation or public PoC exists. A MEDIUM reassessment better reflects the operational reality.

Why this verdict

• DoS-only impact ceiling: All three CVEs have C:N/I:N/A:H — the worst outcome is a service restart, not data breach or persistent compromise. This fundamentally caps severity regardless of deployment role.
• Non-default configuration requirements: CVE-2025-52434 requires the APR/Native connector (most deployments use NIO). CVE-2025-53506 and CVE-2025-52434 require HTTP/2, which is not enabled by default in Tomcat 9.x. This narrows the actually-vulnerable population to an estimated <20% of installations.
• No exploitation evidence: Zero public PoCs, no KEV listing, no threat intel reports, and Tenable's own VPR of 3.0 places these in the bottom quartile of risk. The 34-day disclosure-to-fix window closed cleanly.
• Role multiplier: Tomcat serves as an application server across roles from dev sandboxes (low-value) to production API tiers and identity-adjacent services (high-value). Even in the worst case — a production Tomcat fronting a critical application — the chain terminates at temporary unavailability, not domain takeover or data exfiltration. HA clusters and auto-restart mechanisms further reduce blast radius to seconds of downtime. The DoS-only impact means the high-value-role floor does not elevate to HIGH because the chain outcome is availability loss, not fleet compromise or identity compromise.
• Infrastructure friction: Production Tomcat deployments commonly sit behind reverse proxies, load balancers, or CDN/WAFs that absorb or block the attack patterns (HTTP/2 stream floods, >2GB multipart uploads) before they reach the vulnerable code.

Why not higher?

These CVEs do not enable remote code execution, privilege escalation, or data exfiltration. The blast radius is capped at temporary service unavailability — even on a critical production Tomcat instance, the attacker gains no foothold, no credentials, and no lateral movement capability. Two of three CVEs require non-default configurations, and no exploitation has been observed.

Why not lower?

Despite the friction, all three CVEs are unauthenticated and network-reachable with no user interaction — a motivated attacker can reach them without any prior access. Tomcat is enormously widespread (~378K internet-facing instances), and availability disruption of production services has real business cost. A LOW or IGNORE rating would understate the ease of triggering the condition for the subset of deployments that do run HTTP/2 or APR/Native.

1. Deploy a reverse proxy or WAF in front of Tomcat — A reverse proxy (nginx, Apache httpd, HAProxy) or WAF with HTTP/2 stream limits and request-size enforcement blocks all three attack vectors before traffic reaches Tomcat. Most production deployments already have this. No mitigation SLA for MEDIUM — go straight to the 365-day remediation window.
2. Disable HTTP/2 if not required — Remove the h2 protocol from the <UpgradeProtocol> configuration in server.xml to eliminate the attack surface for CVE-2025-52434 and CVE-2025-53506. This is a zero-cost change if your application doesn't depend on HTTP/2 features.
3. Switch from APR/Native to NIO connector — If you're running the APR/Native connector, switch to NIO or NIO2 in server.xml to eliminate CVE-2025-52434 entirely. NIO is the default and recommended connector for most workloads.
4. Enforce maxPostSize explicitly — Set maxPostSize in your Connector configuration and validate it with application-layer checks. While CVE-2025-52520 bypasses the Tomcat-level check via integer overflow, upstream request-size limits in your reverse proxy will catch the >2GB payload.
5. Enable connection rate limiting — Configure connection rate limiting at the load balancer or reverse proxy layer to throttle rapid connection open/close patterns that trigger CVE-2025-52434's race condition.

Run this script on each Tomcat host (or remotely if you can reach the Tomcat manager/version endpoint). It checks the installed Tomcat version from catalina.sh version or the RELEASE-NOTES file. Requires read access to the Tomcat installation directory. Example: bash check_tomcat_241680.sh /opt/tomcat

#!/bin/bash
# check_tomcat_241680.sh — Tenable 241680 / CVE-2025-52520, CVE-2025-52434, CVE-2025-53506
# Usage: bash check_tomcat_241680.sh /path/to/tomcat
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

CATALINA_HOME="${1:-/opt/tomcat}"
FIXED_MAJOR=9
FIXED_MINOR=0
FIXED_PATCH=107

# Try catalina.sh version first, fall back to RELEASE-NOTES
if [[ -x "${CATALINA_HOME}/bin/catalina.sh" ]]; then
  VERSION_LINE=$("${CATALINA_HOME}/bin/catalina.sh" version 2>/dev/null | grep 'Server number:' || true)
  VERSION=$(echo "$VERSION_LINE" | grep -oP '[0-9]+\.[0-9]+\.[0-9]+' || true)
fi

if [[ -z "${VERSION:-}" ]] && [[ -f "${CATALINA_HOME}/RELEASE-NOTES" ]]; then
  VERSION=$(grep -oP 'Apache Tomcat Version \K[0-9]+\.[0-9]+\.[0-9]+' "${CATALINA_HOME}/RELEASE-NOTES" 2>/dev/null || true)
fi

if [[ -z "${VERSION:-}" ]]; then
  # Try lib/catalina.jar manifest
  if [[ -f "${CATALINA_HOME}/lib/catalina.jar" ]]; then
    VERSION=$(unzip -p "${CATALINA_HOME}/lib/catalina.jar" META-INF/MANIFEST.MF 2>/dev/null | grep -oP 'Implementation-Version: \K[0-9]+\.[0-9]+\.[0-9]+' || true)
  fi
fi

if [[ -z "${VERSION:-}" ]]; then
  echo "UNKNOWN — could not determine Tomcat version at ${CATALINA_HOME}"
  exit 2
fi

IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"

echo "Detected Tomcat version: ${VERSION}"

# Only applies to Tomcat 9.x
if [[ "$MAJOR" -ne 9 ]]; then
  echo "UNKNOWN — Tomcat ${VERSION} is not in the 9.x branch (plugin 241680 covers 9.0.x only)"
  exit 2
fi

if [[ "$MINOR" -gt "$FIXED_MINOR" ]] || { [[ "$MINOR" -eq "$FIXED_MINOR" ]] && [[ "$PATCH" -ge "$FIXED_PATCH" ]]; }; then
  echo "PATCHED — Tomcat ${VERSION} >= 9.0.107"
  exit 0
else
  echo "VULNERABLE — Tomcat ${VERSION} < 9.0.107 (CVE-2025-52520, CVE-2025-52434, CVE-2025-53506)"
  # Check for additional risk factors
  SERVER_XML="${CATALINA_HOME}/conf/server.xml"
  if [[ -f "$SERVER_XML" ]]; then
    if grep -qi 'Apr' "$SERVER_XML" 2>/dev/null; then
      echo "  WARNING: APR/Native connector detected — CVE-2025-52434 applies"
    fi
    if grep -qi 'h2' "$SERVER_XML" 2>/dev/null; then
      echo "  WARNING: HTTP/2 (h2) protocol detected — CVE-2025-52434 and CVE-2025-53506 apply"
    fi
  fi
  exit 1
fi

Sources

1. Tenable Plugin 241680
2. Apache Tomcat 9 Security Advisories
3. CVE-2025-52520 — oss-security Advisory
4. CVE-2025-52434 — GitHub Advisory GHSA-4j3c-42xv-3f84
5. CVE-2025-53506 — GitHub Advisory GHSA-25xr-qj8w-c4vf
6. Rapid7 — CVE-2025-52520
7. Shodan Tomcat CVE Dashboard
8. F5 Advisory K000152908