7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-53506

CVE-2025-53506: Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-53506

CVE-2025-53506:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.tomcat:tomcat-coyote	maven	>= 11.0.0-M1, < 11.0.9	11.0.9
org.apache.tomcat:tomcat-coyote	maven	>= 10.1.0-M1, < 10.1.43	10.1.43
org.apache.tomcat:tomcat-coyote	maven	>= 9.0.0.M1, < 9.0.107	9.0.107
org.apache.tomcat:tomcat-coyote	maven	>= 8.5.0, <= 8.5.100
org.apache.tomcat.embed:tomcat-embed-core	maven	>= 8.5.0, <= 8.5.100
org.apache.tomcat.embed:tomcat-embed-core	maven	>= 9.0.0.M1, < 9.0.107	9.0.107
org.apache.tomcat.embed:tomcat-embed-core	maven	>= 10.1.0-M1, < 10.1.43	10.1.43
org.apache.tomcat.embed:tomcat-embed-core	maven	>= 11.0.0-M1, < 11.0.9	11.0.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2025-53506, allows a remote, unauthenticated attacker to cause a denial of service in Apache Tomcat. The root cause is an uncontrolled resource consumption issue in the Coyote HTTP/2 protocol implementation.

Upon establishing an HTTP/2 connection, the server sends a SETTINGS frame to the client, specifying connection-level parameters, most importantly MAX_CONCURRENT_STREAMS. The vulnerability existed because Tomcat would not enforce this limit until the client acknowledged the settings by sending a SETTINGS frame with the ACK flag. A malicious client could simply refuse to send this acknowledgement and proceed to open an arbitrary number of streams. Each stream consumes server resources (memory and threads), and by opening an excessive number, the client could exhaust these resources, leading to a Denial of Service.

The analysis of the patch commits reveals two key functions involved:

org.apache.coyote.http2.Http2UpgradeHandler.Http2UpgradeHandler(...): This constructor is the entry point for handling a new HTTP/2 connection. It is responsible for configuring the initial settings. The vulnerable code called localSettings.set(...) to establish the stream limit, but this call did not enforce the limit immediately.
org.apache.coyote.http2.ConnectionSettingsLocal.set(...): This method contained the flawed logic. It would place the new setting in a pending map, waiting for client acknowledgement before moving it to the current (enforced) settings map. An attacker could exploit this delay.

The fix involves adding a force parameter to the set methods. The Http2UpgradeHandler now calls set with force=true, which causes ConnectionSettingsLocal.set to apply the MAX_CONCURRENT_STREAMS limit to the current settings immediately, mitigating the DoS risk by ensuring the server enforces the limit regardless of client acknowledgement.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.