CVE-2025-61795: Apache Tomcat Vulnerable to Improper Resource Shutdown or Release

The vulnerability described is a failure to properly clean up resources (temporary files) after a failed multipart upload in Apache Tomcat. The provided commit patches directly address this issue. By analyzing the changes in the Request.java file across the supplied commits, it's clear that the parseParts method is the central point of the vulnerability. The original code lacked a mechanism to guarantee the cleanup of temporary files in case of an exception during the upload parsing process. The fix introduces a finally block to ensure that item.delete() is called on the temporary FileItem objects, regardless of whether the upload parsing was successful or not. Therefore, org.apache.catalina.connector.Request.parseParts is the specific function that contains the flawed logic and would be active during the exploitation of this Denial of Service vulnerability.