[GHSA-25xr-qj8w-c4vf] Uncontrolled Resource Consumption vulnerability in Apache... #5800
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR updates the Apache Tomcat advisory GHSA-25xr-qj8w-c4vf to include affected product versions, a concise summary, additional references, and a defined severity level.
- Added a
"summary"field describing the DoS via excessive HTTP/2 streams - Populated the
"affected"array with Maven package version ranges for bothtomcat-catalinaandtomcat-embed-core - Added new
"WEB"and"PACKAGE"reference URLs and set"severity"to"HIGH"
| "published": "2025-07-10T21:31:53Z", | ||
| "aliases": [ | ||
| "CVE-2025-53506" | ||
| ], | ||
| "summary": "DoS via excessive HTTP/2 streams", | ||
| "details": "Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.\n\nUsers are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.", | ||
| "severity": [], |
There was a problem hiding this comment.
Remove the empty severity array at line 11 to prevent duplicate key definitions and rely on the single "severity": "HIGH" entry.
| "severity": [], | |
Copilot uses AI. Check for mistakes.
There was a problem hiding this comment.
I would gladly update this pull-request, but it looks like while I was able to open it, I cannot update the branch. 🤷
d6ecb4b
into
fabien-chebel/advisory-improvement-5800
|
Hi @fabien-chebel! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future! |
Updates
Comments
Add affected product versions.