7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-52434

CVE-2025-52434: Apache Tomcat Utilities is vulnerable to resource exhaustion when using the APR/Native connector

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.

This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 9.0.107, which fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-52434

CVE-2025-52434:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.tomcat:tomcat-util	maven	>= 9.0.0.M1, < 9.0.107	9.0.107

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic race condition (CWE-362) within the Apache Tomcat APR/Native connector, which is used for high-performance networking. The root cause is the lack of proper synchronization when accessing and modifying the state of a native socket, particularly during connection closing.

Multiple threads could interact with a socket wrapper (AprSocketWrapper) simultaneously. One thread (e.g., a connector thread reacting to a client-initiated close) could be closing the socket, while another thread (e.g., an application thread logging connection details) could be trying to read information like the remote address or port from that same socket.

Without synchronization, the thread reading socket information could access the underlying native socket pointer after it has been closed and deallocated by the other thread. This use-after-free condition in the native APR library can lead to memory corruption, segmentation faults (JVM crashes), or unpredictable behavior, which from the user's perspective, manifests as resource exhaustion or server instability.

The patch addresses this by introducing a comprehensive locking mechanism. A ReentrantLock is now used within the AprSocketWrapper to serialize access to the socket. The close() method and all methods that read socket information (populateRemoteAddr, populateRemoteHost, etc.) now acquire this lock before performing any operations on the socket. This ensures that closing the socket and accessing its properties are atomic operations, eliminating the race condition.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.