GHSA-3p2h-wqq4-wf4h BIT-tomcat-2025-31650 CVE-2025-31650

Apache Tomcat Denial of Service via invalid HTTP priority header

High Maven

Severity: 0.0 / 10; High · CVSS 4.0
Exploit chance (EPSS): 61.32%; Chance of exploitation in the next 30 days. Higher than 99.16% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-459 Incomplete Cleanup; CWE-460 Improper Cleanup on Thrown Exception
Fix: Available; 2 packages have a fixed version

Description

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.

This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100.

Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.

Affected versions

Maven

Package	Vulnerable	Fixed in
org.apache.tomcat.embed:tomcat-embed-core	`>= 9.0.76, < 9.0.104`	`9.0.104`
org.apache.tomcat.embed:tomcat-embed-core	`>= 10.1.10, < 10.1.40`	`10.1.40`
org.apache.tomcat.embed:tomcat-embed-core	`>= 11.0.0-M2, < 11.0.6`	`11.0.6`
org.apache.tomcat.embed:tomcat-embed-core	`>= 8.5.0, <= 8.5.100`	No fix yet
org.apache.tomcat:tomcat-coyote	`>= 9.0.76, < 9.0.104`	`9.0.104`
org.apache.tomcat:tomcat-coyote	`>= 10.1.10, < 10.1.40`	`10.1.40`
org.apache.tomcat:tomcat-coyote	`>= 11.0.0-M2, < 11.0.6`	`11.0.6`
org.apache.tomcat:tomcat-coyote	`>= 8.5.0, <= 8.5.100`	No fix yet

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

org.apache.tomcat.embed:tomcat-embed-core Maven → `9.0.104`

maven

<dependency><groupId>org.apache.tomcat.embed</groupId><artifactId>tomcat-embed-core</artifactId><version>9.0.104</version></dependency>

gradle

implementation("org.apache.tomcat.embed:tomcat-embed-core:9.0.104")

org.apache.tomcat:tomcat-coyote Maven → `9.0.104`

maven

<dependency><groupId>org.apache.tomcat</groupId><artifactId>tomcat-coyote</artifactId><version>9.0.104</version></dependency>

gradle

implementation("org.apache.tomcat:tomcat-coyote:9.0.104")

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality (vulnerable system): None
Integrity (vulnerable system): None
Availability (vulnerable system): High
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None
Exploit maturity: Unreported

CVSS 3.1 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Weakness

CWE-459: Incomplete Cleanup

The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

How to prevent it

Architecture and Design, Implementation: Temporary files and other supporting resources should be deleted/released immediately after they are no longer needed.

CWE-460: Improper Cleanup on Thrown Exception

The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.

How to prevent it

Implementation: If one breaks from a loop or function by throwing an exception, make sure that cleanup happens or that you should exit the program. Use throwing exceptions sparsely.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2025-31650

Packages

github.com/apache/tomcat

Timeline

Apr 28, 2025 Published
Sep 10, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-83qj-6fr2-vhqg Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT	Critical Known exploited	Also affects org.apache.tomcat.embed:tomcat-embed-core
GHSA-qppj-fm5r-hxr3 HTTP/2 Stream Cancellation Attack	Medium Known exploited	Also affects org.apache.tomcat.embed:tomcat-embed-core
GHSA-xjgh-84hx-56c5 Unrestricted Upload of File with Dangerous Type Apache Tomcat	High Known exploited	Also affects org.apache.tomcat.embed:tomcat-embed-core
CVE-2020-1938 Improper Privilege Management in Tomcat	Critical Known exploited	Also affects org.apache.tomcat.embed:tomcat-embed-core
GHSA-pjfr-qf3p-3q25 When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the server	High Known exploited	Also affects org.apache.tomcat.embed:tomcat-embed-core
GHSA-h3x4-894j-xpx5 Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability	Critical	Also affects org.apache.tomcat.embed:tomcat-embed-core
GHSA-9xv2-5v5q-p794 Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability	Critical	Also affects org.apache.tomcat.embed:tomcat-embed-core
GHSA-f525-44xv-f2qj Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation	Critical	Also affects org.apache.tomcat.embed:tomcat-embed-core

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor