CVE-2025-61795: 
Java vulnerability analysis and mitigation

CVE-2025-61795 is an Improper Resource Shutdown or Release vulnerability affecting Apache Tomcat. The vulnerability was discovered and disclosed on October 27, 2025. It affects multiple versions of Apache Tomcat including versions 11.0.0-M1 through 11.0.11, 10.1.0-M1 through 10.1.46, 9.0.0.M1 through 9.0.109, and EOL versions 8.5.0 through 8.5.100 (NVD, Security Online).

The vulnerability occurs during the processing of multipart uploads where temporary copies of uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. The severity is rated as MEDIUM with a CVSS 3.1 Base Score of 5.3 (Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H). The vulnerability is classified under CWE-404 (Improper Resource Shutdown or Release) (NVD).

Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than the garbage collection could clear it, potentially leading to a Denial of Service (DoS) condition (Security Online).

Users are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later, or 9.0.110 or later which fixes the issue. These patched versions address the improper resource cleanup vulnerability (NVD).