CVE-2025-48988
HIGHApache Tomcat - Allocation of Resources Without Limits or Throttling
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2025-48988. PoCs published by nankuo, Samb102.
AI-analyzed exploit summary This PoC exploits a multipart/form-data parsing vulnerability in a JSP application by sending a large number of crafted multipart requests with excessive headers, likely causing a DoS condition. The script continuously sends payloads to the target endpoint, demonstrating the vulnerability's exploitability.
Description
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
Exploits (2)
This PoC exploits a multipart/form-data parsing vulnerability in a JSP application by sending a large number of crafted multipart requests with excessive headers, likely causing a DoS condition. The script continuously sends payloads to the target endpoint, demonstrating the vulnerability's exploitability.
This repository contains a functional PoC for CVE-2025-48988, demonstrating a DoS vulnerability in Tomcat 10.1.41 via excessive multipart request processing. The exploit sends parallelized requests with numerous parts and headers, causing high CPU usage.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H