CVE-2025-31650
published 2025-04-28CVE-2025-31650: Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of…
PriorityP268high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EXPLOIT
EPSS
66.93%
99.2th percentile
Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.
This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.90 though 8.5.100.
Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | — | — |
| apache | tomcat | >= 10.1.10 < 10.1.40 | 10.1.40 |
| apache | tomcat | >= 11.0.1 < 11.0.6 | 11.0.6 |
| apache | tomcat | >= 9.0.76 < 9.0.104 | 9.0.104 |
| apache_software_foundation | apache_tomcat | 10.1.10 – 10.1.39 | — |
| apache_software_foundation | apache_tomcat | 11.0.0-M2 – 11.0.5 | — |
| apache_software_foundation | apache_tomcat | 8.5.90 – 8.5.100 | — |
| apache_software_foundation | apache_tomcat | 9.0.76 – 9.0.102 | — |
| debian | tomcat10 | < tomcat10 10.1.40-1 (bookworm) | tomcat10 10.1.40-1 (bookworm) |
| debian | tomcat11 | < tomcat10 10.1.40-1 (bookworm) | tomcat10 10.1.40-1 (bookworm) |
| debian | tomcat9 | < tomcat10 10.1.40-1 (bookworm) | tomcat10 10.1.40-1 (bookworm) |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect exploit traffic by matching the 'priority' HTTP/2 header containing malformed values such as negative urgency, non-numeric quality values, integer overflow values, or NaN — characteristic of CVE-2025-31650 DoS attempts. ↗
- →Monitor Apache Tomcat logs (catalina.out) for OutOfMemoryError occurrences, which indicate active exploitation of the memory leak triggered by malformed HTTP/2 PRIORITY_UPDATE frames. ↗
- →This vulnerability requires HTTP/2 to be enabled on the target; detection should focus on HTTP/2 traffic (ALPN h2) to Apache Tomcat instances running versions 9.0.76–9.0.102, 10.1.10–10.1.39, or 11.0.0-M2–11.0.5. ↗
- →The attack is unauthenticated and targets no specific endpoint — any path on the server can be used; detection should not rely on specific URI patterns but instead on the malformed 'priority' header value. ↗
- ·Exploitation requires HTTP/2 to be active on the Tomcat instance. If HTTP/2 is disabled or not negotiated (ALPN), the server is not vulnerable to this specific attack vector. ↗
- ·No configuration-level mitigation is available for this CVE; the only fix is upgrading to Apache Tomcat 9.0.104, 10.1.40, or 11.0.6. ↗
- ·EOL versions 8.5.90 through 8.5.100 are confirmed affected but have no fix available from upstream. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv9.8CRITICAL
vendor_ubuntu9.8CRITICAL
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Tomcat vulnerabilities
vendor_ubuntu·2025-08-20·CVSS 9.8
CVE-2024-50379 [CRITICAL] Tomcat vulnerabilities
Title: Tomcat vulnerabilities
Summary: Several security issues were fixed in Tomcat.
It was discovered that Tomcat did not correctly handle case sensitivity.
An attacker could possibly use this issue to bypass authentication
mechanisms. (CVE-2025-46701)
Elysee Franchuk discovered that Tomcat did not correctly limit the number
of attributes for a session. An attacker could possibly use this issue to
cause a denial of service. This issue only affected Ubuntu 24.04 LTS.
(CVE-2024-54677)
It was discovered that Tomcat did not correctly sanitize certain URLs. An
attacker could possibly use this issue to bypass authentication
mechanisms. (CVE-2025-31651)
It was discovered that Tomcat did not correctly handle certain malformed
HTTP headers,
which could lead to a memory leak. An attacker could
Red Hat
tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame
vendor_redhat·2025-04-28·CVSS 7.5
CVE-2025-31650 [HIGH] CWE-20 tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame
tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame
Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.
This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.90 though 8.5.100.
Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.
A flaw was found in Apache Tomcat. This vulnerability allows an application-level deni
Debian
CVE-2025-31650: tomcat10 - Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handli...
vendor_debian·2025·CVSS 7.5
CVE-2025-31650 [HIGH] CVE-2025-31650: tomcat10 - Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handli...
Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.
Scope: local
bookworm: resolved (fixed in 10.1.40-1)
forky: resolved (fixed in 10.1.40-1)
sid: resolved (fixed in 10.1.40-1)
trixie: resolved (fixed in 10.1.4
OSV
tomcat10 vulnerabilities
osv·2025-08-20·CVSS 9.8
CVE-2025-46701 [CRITICAL] tomcat10 vulnerabilities
tomcat10 vulnerabilities
It was discovered that Tomcat did not correctly handle case sensitivity.
An attacker could possibly use this issue to bypass authentication
mechanisms. (CVE-2025-46701)
Elysee Franchuk discovered that Tomcat did not correctly limit the number
of attributes for a session. An attacker could possibly use this issue to
cause a denial of service. This issue only affected Ubuntu 24.04 LTS.
(CVE-2024-54677)
It was discovered that Tomcat did not correctly sanitize certain URLs. An
attacker could possibly use this issue to bypass authentication
mechanisms. (CVE-2025-31651)
It was discovered that Tomcat did not correctly handle certain malformed
HTTP headers,
which could lead to a memory leak. An attacker could possibly use this
issue to cause a denial of service. This i
OSV
CVE-2025-31650: Improper Input Validation vulnerability in Apache Tomcat
osv·2025-04-28·CVSS 7.5
CVE-2025-31650 [HIGH] CVE-2025-31650: Improper Input Validation vulnerability in Apache Tomcat
Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.
OSV
Apache Tomcat Denial of Service via invalid HTTP priority header
osv·2025-04-28
CVE-2025-31650 [MEDIUM] Apache Tomcat Denial of Service via invalid HTTP priority header
Apache Tomcat Denial of Service via invalid HTTP priority header
Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.
This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100.
Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.
GHSA
Apache Tomcat Denial of Service via invalid HTTP priority header
ghsa·2025-04-28
CVE-2025-31650 [MEDIUM] CWE-459 Apache Tomcat Denial of Service via invalid HTTP priority header
Apache Tomcat Denial of Service via invalid HTTP priority header
Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.
This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100.
Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.
No detection rules found.
2025-04-28
Published