Apache Tomcat is one of the most widely used Java servlet containers in the world, powering countless web applications across industries. That popularity makes it a prime target for attackers—and a newly disclosed flaw has raised fresh concerns.
The vulnerability, tracked as CVE-2025-48989, affects Tomcat's HTTP/2 implementation and has been given a CVSS score of 7.5 (High). The flaw allows attackers to launch denial-of-service (DoS) attacks, potentially crippling web servers by exhausting their memory.
Understanding the "Made You Reset" Attack
Researchers have dubbed this exploit the "Made You Reset" attack, and the name fits. The flaw revolves around how Apache Tomcat handles HTTP/2 stream resets and connection states.
Here's the breakdown:
The attack is particularly effective because it leverages HTTP/2's multiplexing feature, which allows multiple streams to run simultaneously over a single TCP connection. By manipulating stream resets, attackers can create a flood of half-open or incomplete streams that quickly eat up server resources.
Who's Affected?
The scope of impact is broad. Vulnerable versions include:
Older end-of-life Tomcat versions may also be at risk, which is worrying considering the large number of legacy systems still in use worldwide.
Why the Severity Is High
While the vulnerability doesn't allow remote code execution or data theft, the business impact of downtime is massive. Imagine a large-scale e-commerce site or a financial service being hit with this attack during peak hours. Service outages not only harm revenue but also damage customer trust.
Because Tomcat powers critical applications across industries, even a few minutes of downtime could mean major disruption.
What You Should Do Now
The Apache Software Foundation has already released patched versions to fix the issue. The secure versions are:
If your systems are running any earlier builds, you should update immediately.
Additional Defensive Measures
Beyond patching, system administrators are encouraged to:
Final Thoughts
The "Made You Reset" attack is a reminder that even mature, widely trusted platforms like Apache Tomcat aren't immune to flaws. While this vulnerability doesn't compromise data directly, its ability to knock servers offline makes it a powerful weapon for attackers aiming to cause disruption.
For organizations, the takeaway is clear: patch immediately, monitor actively, and reinforce your defenses. A few proactive steps today could prevent hours—or even days—of costly downtime tomorrow.
Comments