Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections. This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106. Users are recommended to upgrade to version 9.0.107, which fixes the issue.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

No data.

No data.

No data.

References
Link Providers
https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030 cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-52434 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-52434 cve-icon
History

Wed, 16 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.0006}

 epss

{'score': 0.00078}

Sat, 12 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00018}

 epss

{'score': 0.0006}

Fri, 11 Jul 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Fri, 11 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00018}

Fri, 11 Jul 2025 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

epss

{}

threat_severity

Moderate

Thu, 10 Jul 2025 19:15:00 +0000

Type Values Removed Values Added
Description Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections. This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106. Users are recommended to upgrade to version 9.0.107, which fixes the issue.
Title Apache Tomcat: APR/Native Connector crash leading to DoS
Weaknesses CWE-362
References
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published: 2025-07-10T19:03:47.225Z

Updated: 2025-07-11T14:04:04.250Z

Reserved: 2025-06-16T07:00:46.986Z

Link: CVE-2025-52434

cve-icon Vulnrichment

Updated: 2025-07-11T14:03:36.267Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-07-10T19:15:25.220

Modified: 2025-07-15T13:14:49.980

Link: CVE-2025-52434

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-07-10T19:03:47Z

Links: CVE-2025-52434 - Bugzilla