CVE-2025-31650
Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame
HIGH 7.5
At a glance
- Source
- NVD
- EPSS
- EPSS 61.32 % · percentile 99 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- apache
- NVD status
- Modified
Description
Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.
Weaknesses (CWE)
- CWE-459 — Incomplete Cleanup
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | CISA-ADP |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Advisories
- GHSA-3p2h-wqq4-wf4h — Apache Tomcat Denial of Service via invalid HTTP priority header
European references
- ENISA EUVD · EUVD-2025-13627
- GCVE · GCVE-0-2025-31650
CERT-FR advisories
- CERTFR-2026-AVI-0395 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0322 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0754 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0622 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0585 — Multiples vulnérabilités dans VMware Tanzu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0530 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0524 — Multiples vulnérabilités dans VMware Tanzu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0520 — Multiples vulnérabilités dans les produits Atlassian · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0435 — Multiples vulnérabilités dans les produits Atlassian · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0352 — Multiples vulnérabilités dans Apache Tomcat · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*≥ 9.0.76 < 9.0.104cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*≥ 10.1.10 < 10.1.40cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*≥ 11.0.1 < 11.0.6cpe:2.3:a:apache:tomcat:11.0.0:milestone10:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone11:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone12:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone13:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone14:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone15:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone16:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone17:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone18:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone19:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone20:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone21:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone22:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone23:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone24:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone25:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone3:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone4:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone5:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone6:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone7:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone8:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone9:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Apache Software Foundation · Apache Tomcat | affected 9.0.76 ≤ 9.0.102 ; affected 10.1.10 ≤ 10.1.39 ; affected 11.0.0-M2 ≤ 11.0.5 ; affected 8.5.90 ≤ 8.5.100 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |