This vulnerability in Apache Tomcat involves allocation of resources without proper limits or throttling, which can cause denial of service conditions. It affects multiple major release lines: 11.x from 11.0.0-M1 up to 11.0.7, 10.1.x from 10.1.0-M1 up to 10.1.41, and 9.0.x from 9.0.0-M1 up to 9.0.105. Additionally, older end-of-life versions such as 8.5.0 through 8.5.100 are known to be affected. The issue is addressed in versions 11.0.8, 10.1.42, and 9.0.106. The vulnerability is characterized by the lack of resource allocation limits or throttling, which can be exploited to exhaust server resources and cause service disruption.

The vulnerability allows an attacker to cause denial of service by exhausting server resources due to the lack of limits or throttling on resource allocation. There is no impact on confidentiality or integrity reported. The CVSS vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and an impact limited to availability (A:H). No known exploits in the wild have been reported.

A fix is available. Users should upgrade affected Apache Tomcat versions to 11.0.8, 10.1.42, or 9.0.106 as appropriate. Applying these updates will remediate the vulnerability by introducing proper resource allocation limits and throttling. No other mitigation steps are indicated by the vendor advisory.