CVE-2025-52434: Apache Tomcat Utilities is vulnerable to resource exhaustion when using the APR/Native connector

The vulnerability is a classic race condition (CWE-362) within the Apache Tomcat APR/Native connector, which is used for high-performance networking. The root cause is the lack of proper synchronization when accessing and modifying the state of a native socket, particularly during connection closing.

Multiple threads could interact with a socket wrapper (AprSocketWrapper) simultaneously. One thread (e.g., a connector thread reacting to a client-initiated close) could be closing the socket, while another thread (e.g., an application thread logging connection details) could be trying to read information like the remote address or port from that same socket.

Without synchronization, the thread reading socket information could access the underlying native socket pointer after it has been closed and deallocated by the other thread. This use-after-free condition in the native APR library can lead to memory corruption, segmentation faults (JVM crashes), or unpredictable behavior, which from the user's perspective, manifests as resource exhaustion or server instability.

The patch addresses this by introducing a comprehensive locking mechanism. A ReentrantLock is now used within the AprSocketWrapper to serialize access to the socket. The close() method and all methods that read socket information (populateRemoteAddr, populateRemoteHost, etc.) now acquire this lock before performing any operations on the socket. This ensures that closing the socket and accessing its properties are atomic operations, eliminating the race condition.