diff --git a/advisories/github-reviewed/2025/07/GHSA-4j3c-42xv-3f84/GHSA-4j3c-42xv-3f84.json b/advisories/github-reviewed/2025/07/GHSA-4j3c-42xv-3f84/GHSA-4j3c-42xv-3f84.json index 308e987326cdf..18de2577b75a4 100644 --- a/advisories/github-reviewed/2025/07/GHSA-4j3c-42xv-3f84/GHSA-4j3c-42xv-3f84.json +++ b/advisories/github-reviewed/2025/07/GHSA-4j3c-42xv-3f84/GHSA-4j3c-42xv-3f84.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4j3c-42xv-3f84", - "modified": "2025-11-05T20:14:29Z", + "modified": "2025-11-05T20:14:32Z", "published": "2025-07-10T21:31:52Z", "aliases": [ "CVE-2025-52434" @@ -9,20 +9,54 @@ "summary": "Apache Tomcat Utilities is vulnerable to resource exhaustion when using the APR/Native connector", "details": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.\n\nThis issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 9.0.107, which fixes the issue.", "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" - }, { "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U" + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H" } ], "affected": [ { "package": { "ecosystem": "Maven", - "name": "org.apache.tomcat:tomcat-util" + "name": "org.apache.tomcat.embed:tomcat-embed-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0.M1" + }, + { + "fixed": "9.0.107" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat.embed:tomcat-embed-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.5.0" + }, + { + "last_affected": "8.5.100" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat:tomcat-coyote" }, "ranges": [ { @@ -41,7 +75,7 @@ { "package": { "ecosystem": "Maven", - "name": "org.apache.tomcat:tomcat-util" + "name": "org.apache.tomcat:tomcat-coyote" }, "ranges": [ { @@ -88,7 +122,7 @@ "cwe_ids": [ "CWE-362" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2025-07-10T22:55:26Z", "nvd_published_at": "2025-07-10T19:15:25Z"