CVE-2025-48988

This is a weakness in how Tomcat handles certain file-upload requests. An attacker can send an upload designed like a delivery truck packed with thousands of tiny boxes, tying up the receiving desk until the application becomes unavailable.

This matters to you if you run Apache Tomcat directly or use an application that includes it. It is especially relevant where your application accepts file uploads or multipart form submissions from people outside your organization.

A public proof-of-concept is available, making this a credible disruption risk for exposed systems. It is not listed in CISA's catalog of vulnerabilities known to be actively exploited, so this is an amber priority: schedule the upgrade promptly and protect exposed upload services in the meantime.

Confirm the deployed Tomcat version from the server installation, container image, or application dependency list, and identify internet-facing endpoints that accept multipart/form-data uploads. Upgrade within the matching supported branch: 11.x to 11.0.8 or later, 10.1.x to 10.1.42 or later, or 9.0.x to 9.0.106 or later; update org.apache.tomcat:tomcat-catalina and/or org.apache.tomcat.embed:tomcat-embed-core when Tomcat is bundled through Maven. Test upload workflows in a staging environment before production rollout, especially if the application has custom upload handling. If patching is delayed, temporarily disable or place authentication and rate limits in front of public upload endpoints where feasible. No CISA KEV remediation due date applies. Monitor web/application logs and capacity metrics for repeated multipart requests, unusually high request-part counts, rising CPU or memory use, and service unavailability.

CVSS 3.1: 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). CWE-770: allocation of resources without limits or throttling. The attack is network-reachable and targets multipart upload handling with a large number of parts containing headers, resulting in denial of service. A public GitHub PoC is known. EPSS is 30.5% (98th percentile) and rising, indicating elevated predicted exploitation likelihood; the vulnerability is not in CISA KEV, and confirmed in-the-wild exploitation is not established by the supplied findings.