BSD PortsApache Tomcat -- Multiple Vulnerabilities
· CVE-2025-52434, CVE-2025-52520, CVE-2025-53506 · VuXML entry
[email protected] reports: A race condition on connection close could trigger a JVM crash when using the APR/Native connector leading to a DoS. This was particularly noticeable with client initiated closes of HTTP/2 connections. An uncontrolled resource consumption vulnerability if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams could result in …
Affected versions
- tomcat110 >= 11.0.0 < 11.0.9
- tomcat101 >= 10.1.0 < 10.1.43
- tomcat9 >= 9.0.0 < 9.0.107
By system
3 still vulnerable, 3 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | www/tomcat110 | 11.0.8 | vulnerable since 2025-07-10 | |
| MidnightBSD | www/tomcat110 | 11.0.27 | out of range, by version | |
| FreeBSD | www/tomcat110 | 11.0.27 | fixed | (363 days after) |
| DragonFly | www/tomcat101 | 10.1.42 | vulnerable since 2025-07-10 | |
| MidnightBSD | www/tomcat101 | 10.1.61 | out of range, by version | |
| FreeBSD | www/tomcat101 | 10.1.61 | fixed | (363 days after) |
| DragonFly | www/tomcat9 | 9.0.106 | vulnerable since 2025-07-10 | |
| MidnightBSD | www/tomcat9 | 9.0.123 | out of range, by version | |
| FreeBSD | www/tomcat9 | 9.0.123 | fixed | (363 days after) |