Apache Tomcat: DoS in examples web application

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• apache tomcat9.0.0 and later · before 9.0.98
• apache tomcat10.1.0 and later · before 10.1.34
• apache tomcat11.0.0 and later · before 11.0.2
• netapp bootstrap osall versions

Versions reported by the vendor

Affected version ranges reported by the assigning authority (apache). Independent of NVD's CPE analysis and usually ahead of it.

• Apache Software Foundation Apache Tomcat

  • 11.0.0-M1 and later · up to and including 11.0.1affected · semver
  • 10.1.0-M1 and later · up to and including 10.1.33affected · semver
  • 9.0.0.M1 and later · up to and including 9.0.97affected · semver
  • 8.5.0 and later · up to and including 8.5.100affected · semver
  • 3 and later · before 8.5.0unknown · semver
  • 10.0.0-M1 and later · up to and including 10.0.27unknown · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2025-24813Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUTKEV
  99Now
• CVE-2016-8735Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x beforeKEV
  96Now
• CVE-2017-12617When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g.KEV
  92Now
• CVE-2017-12615When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g.KEV
  92Now
• CVE-2026-34486Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptorKEV
  62This week
• CVE-2019-0232When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0
  62This week

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

Code that parses nested structures sets no depth or size limit. A small input can turn into a disproportionate processing load.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1function expand(node) {2  return node.children.map(expand);3}

1const MAX_DEPTH = 32;2function expand(node, depth = 0) {3  if (depth > MAX_DEPTH) throw new Error("too deep");4  return node.children.map((c) => expand(c, depth + 1));5}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.