samb102/poc-cve-2025-48988-cve-2025-48976Proof-of-concept exploit for Tomcat CVEs causing CPU exhaustion via parallel multipart requests, with Docker setup and remediation guidance.
This project runs a simple file upload endpoint with Tomcat 10.1.41 and a Jakarta Servlet.
The exploit runs, by default, 1000 parallelized multipart requests with 1000 parts and 50 headers by part, from 50 workers.
Build and run the Docker container:
docker build -t poc-cve-2025-48988 .
docker run -p 8080:8080 poc-cve-2025-48988
Launch the exploit:
python3 exploit-cve-2025-48988.py
Monitor container resource usage:
docker stats
You will observe a significant increase in CPU usage:
Change docker image in dockerfile from tomcat:10.1.41-jdk17 to tomcat:10.1.42-jdk17
With its default configuration, Tomcat will now respond with a 500 status code and CPU usage will remain stable, as per fix introduced in Tomcat 10.1.42.
