Apache Tomcat up to 9.0.106 APR Native Connector race condition

Summaryinfo

A vulnerability has been found in Apache Tomcat up to 9.0.106 and classified as problematic. This impacts an unknown function of the component APR Native Connector. This manipulation causes race condition. The identification of this vulnerability is CVE-2025-52434. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in Apache Tomcat up to 9.0.106 and classified as problematic. Affected by this vulnerability is an unknown part of the component APR Native Connector. The manipulation with an unknown input leads to a race condition vulnerability. The CWE definition for the vulnerability is CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections. This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106. Users are recommended to upgrade to version 9.0.107, which fixes the issue.

The weakness was shared by Nacl, 12SqweR, WHOAMI and yyzmoon. It is possible to read the advisory at lists.apache.org. This vulnerability is known as CVE-2025-52434 since 06/16/2025. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 241680 (Apache Tomcat 9.0.0.M1 < 9.0.107 multiple vulnerabilities), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 9.0.107 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (241680), EUVD (EUVD-2025-21045) and CERT Bund (WID-SEC-2025-1468). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Debian Linux
• Amazon Linux 2
• IBM Power Hardware Management Console
• Red Hat Enterprise Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• RESF Rocky Linux
• Apache Tomcat
• Red Hat JBoss Web Server
• Open Source Camunda
• IBM Integration Bus
• Atlassian Bamboo
• Atlassian Bitbucket
• Atlassian Jira
• Absolute Secure Access
• SAS Institute Base SAS
• Dell Secure Connect Gateway
• Dell NetWorker

Productinfo

Type

• Application Server Software

Vendor

• Apache

Name

• Tomcat

Version

• 9.0.106

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion