7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-48989

CVE-2025-48989: Apache Tomcat: h2 DoS - Made You Reset

Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.

Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-48989

CVE-2025-48989:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.tomcat:tomcat-coyote	maven	>= 11.0.0-M1, < 11.0.10	11.0.10
org.apache.tomcat:tomcat-coyote	maven	>= 10.1.0-M1, < 10.1.44	10.1.44
org.apache.tomcat:tomcat-coyote	maven	>= 9.0.0.M1, < 9.0.108	9.0.108

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as CVE-2025-48989, is a resource exhaustion issue in Apache Tomcat's HTTP/2 implementation, also known as the 'made you reset attack'. The core of the problem is the failure to account for the overhead of handling HTTP/2 RST_STREAM frames. Tomcat employs an overhead counting mechanism to prevent clients from consuming excessive server resources with control frames. However, the functions responsible for sending RST_STREAM frames, sendStreamReset in Http2UpgradeHandler and Http2AsyncUpgradeHandler, did not increment this counter. An attacker could exploit this by initiating a large number of streams and then immediately resetting them. Because these reset actions were not being tracked, the attacker could bypass the server's protective measures, leading to resource depletion and a denial of service. The provided patches fix this by adding a call to increaseOverheadCount in the sendStreamReset methods, ensuring that stream resets are properly accounted for in the overhead calculation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.