First noted in the National Vulnerability Database five days ago, the weakness stems from Coyote’s failure to enforce a hard cap on concurrent streams when an HTTP/2 client never acknowledges the server’s initial SETTINGS frame. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. GitHub analysts subsequently traced the issue to a race condition introduced during the refactor that added dynamic stream limits, publishing proof-of-concept traffic captures that reliably crash unpatched builds. Modern reverse proxies that enforce a SETTINGS-ack timeout or hard stream ceiling neutralize the attack, making upstream mitigation practical until full patch deployment. By repeatedly initiating streams that are never closed, a remote attacker can exhaust the server’s thread pool and force the container into a prolonged denial-of-service state, even though confidentiality and integrity remain unaffected. A newly disclosed flaw in Apache Tomcat’s Coyote engine—tracked as CVE-2025-53506—has surfaced in the latest round of HTTP/2 security advisories. Apache has released fixed versions 11.0.9, 10.1.43, and 9.0.107; administrators that cannot upgrade immediately should at least disable HTTP/2 or limit maxConcurrentStreams at the reverse-proxy layer to avoid service interruptions. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. Because the exploit rides ordinary TCP port 443 traffic, firewalls see nothing suspicious; attack complexity remains low, and no credentials are required. Because Tomcat allocates a worker per stream before receiving any actual data, each orphaned stream ties up a thread indefinitely. CVSS v4 scores the flaw 6.3, tagging availability as High while leaving other impact metrics at None, underscoring its DoS-centric profile.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 15 Jul 2025 19:10:13 +0000