The vulnerabilities exploit different attack vectors, including HTTP/2 protocol weaknesses, file upload mechanisms, and stream handling capabilities. Organizations running affected versions should immediately upgrade to Apache Tomcat 9.0.107 to mitigate these security risks and prevent potential service disruptions. Exploits target the HTTP/2 protocol with APR/Native, file upload integer overflow, and excessive HTTP/2 stream creation. The APR/Native connector, which provides enhanced performance through native library integration, becomes susceptible to resource exhaustion attacks when processing malformed or excessive HTTP/2 requests. The remediation, implemented in commit 927d66fb, introduces robust input validation and proper integer bounds checking for file upload operations. This attack vector exploits the HTTP/2 multiplexing feature, where multiple streams can be processed simultaneously over a single TCP connection. Web applications with file upload functionality should implement additional validation layers at the application level as a defense-in-depth strategy. Network administrators should configure appropriate values for maxConcurrentStreams and monitor HTTP/2 connection patterns to detect potential abuse. The fix introduces stricter boundary checks and connection lifecycle management to prevent resource depletion scenarios.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 09 Jul 2025 10:00:13 +0000