CVE-2025-48989: Apache Tomcat Improper Resource Shutdown or Release vulnerability

The vulnerability, identified as CVE-2025-48989, is a resource exhaustion issue in Apache Tomcat's HTTP/2 implementation, also known as the 'made you reset attack'. The core of the problem is the failure to account for the overhead of handling HTTP/2 RST_STREAM frames. Tomcat employs an overhead counting mechanism to prevent clients from consuming excessive server resources with control frames. However, the functions responsible for sending RST_STREAM frames, sendStreamReset in Http2UpgradeHandler and Http2AsyncUpgradeHandler, did not increment this counter. An attacker could exploit this by initiating a large number of streams and then immediately resetting them. Because these reset actions were not being tracked, the attacker could bypass the server's protective measures, leading to resource depletion and a denial of service. The provided patches fix this by adding a call to increaseOverheadCount in the sendStreamReset methods, ensuring that stream resets are properly accounted for in the overhead calculation.