Get a Demo

Let's Patch It!

Book a short call with one our specialists, we'll walk you through how Endor Patches work, and ask you a few questions about your environment (like your primary programming languages and repository management). We'll also send you an email right after you fill out the form, feel free to reply with any questions you have in advance!

cve-2025-48989
Back to All
CVE

CVE-2025-48989

Apache Tomcat Improper Resource Shutdown or Release vulnerability

Description

Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.

Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.

Base CVSS

7.5

EPSS Score

0.21%

Introduced Version

8.5.0

Fix Available

11.0.10,9.0.108,10.1.44

Available Patches

Package
CVEs Fixed
Lines of Code Changed
Package Name
org.apache.tomcat.embed:tomcat-embed-core
11.0.2
7 CVES Fixed
C
0
H
7
M
0
L
0
Code Changed
+397
-159

References

https://lists.apache.org/thread/9ydfg0xr0tchmglcprhxgwhj0hfwxlyf
https://github.com/apache/tomcat/commit/73c04a10395774bda71a0b37802cf983662ce255
https://nvd.nist.gov/vuln/detail/CVE-2025-48989
https://github.com/apache/tomcat/commit/f36b8a4eea4ce8a0bc035079e1d259d29f5eb7bf
https://github.com/apache/tomcat/commit/f362c8eb3b8ec5b7f312f7f5610731c0fb299a06
https://tomcat.apache.org/security-10.html
https://tomcat.apache.org/security-11.html
https://tomcat.apache.org/security-9.html
https://github.com/apache/tomcat

AppSec for the Software Development Revolution

Endor Labs builds a complete graph of your software estate, so teams can pinpoint and fix critical risks in complex, dependency-rich code—whether it was written by humans or AI.

Welcome to the resistance
Oops! Something went wrong, please try again.