CVE-2025-53506

Summary

Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams

Severity

high

EPSS

1.9% (p77)

Also known as

GHSA-25xr-qj8w-c4vf#org.apache.tomcat:tomcat-coyote, GHSA-25xr-qj8w-c4vf#org.apache.tomcat.embed:tomcat-embed-core, BIT-tomcat-2025-53506

Published

2025-07-10

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-53506
• https://github.com/apache/tomcat/commit/2aa6261276ebe50b99276953591e3a2be7898bdb
• https://github.com/apache/tomcat/commit/434772930f362145516dd60681134e7f0cf8115b

Related advisories

• CVE-2026-29129 — high · Maven/org.apache.tomcat:tomcat-coyote
• CVE-2026-24880 — high · Maven/org.apache.tomcat:tomcat-coyote
• CVE-2026-24734 — high · Maven/org.apache.tomcat:tomcat-coyote
• CVE-2025-48989 — high · Maven/org.apache.tomcat:tomcat-coyote
• CVE-2024-34750 — high · Maven/org.apache.tomcat:tomcat-coyote
• CVE-2026-32990 — medium · Maven/org.apache.tomcat:tomcat-coyote
• CVE-2025-66614 — medium · Maven/org.apache.tomcat:tomcat-coyote
• CVE-2025-31650 — medium · Maven/org.apache.tomcat:tomcat-coyote

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity