CVE-2025-31650

Published Apr 28, 2025

Last updated 2 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-31650 is an improper input validation vulnerability in Apache Tomcat. The vulnerability arises from incorrect error handling of invalid HTTP priority headers, leading to incomplete cleanup of failed requests and a memory leak. By sending a large number of requests with malformed HTTP priority headers, an attacker can trigger an OutOfMemoryException, resulting in a denial-of-service (DoS) condition. This affects Apache Tomcat versions 9.0.76 through 9.0.102, 10.1.10 through 10.1.39, and 11.0.0-M2 through 11.0.5. Users are advised to upgrade to versions 9.0.104, 10.1.40, or 11.0.6 to mitigate the risk.

Description: Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.
Source: security@apache.org
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

Weaknesses

security@apache.org: CWE-459
nvd@nist.gov: CWE-459

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6F4F87EB-0046-4BAA-91C8-C60C60425186",
            "versionEndExcluding": "9.0.104",
            "versionStartIncluding": "9.0.76"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7EC8AA6F-0BB4-4075-8F2B-DE39FD9A2BD8",
            "versionEndExcluding": "10.1.40",
            "versionStartIncluding": "10.1.10"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "45AB4386-DB38-4808-924A-617CECE9F939",
            "versionEndExcluding": "11.0.6",
            "versionStartIncluding": "11.0.1"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone10:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "57088BDD-A136-45EF-A8A1-2EBF79CEC2CE"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone11:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B32D1D7A-A04F-444E-8F45-BB9A9E4B0199"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone12:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0092FB35-3B00-484F-A24D-7828396A4FF6"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone13:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CB557E88-FA9D-4B69-AA6F-EAEE7F9B01AC"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone14:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "72D3C6F1-84FA-4F82-96C1-9A8DA1C1F30F"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone15:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3521C81B-37D9-48FC-9540-D0D333B9A4A4"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone16:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "02A84634-A8F2-4BA9-B9F3-BEF36AEC5480"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone17:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "ECBBC1F1-C86B-40AF-B740-A99F6B27682A"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone18:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9D2206B2-F3FF-43F2-B3E2-3CAAC64C691D"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone19:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0495A538-4102-40D0-A35C-0179CFD52A9D"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2AAD52CE-94F5-4F98-A027-9A7E68818CB6"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone20:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "77BA6600-0890-4BA1-B447-EC1746BAB4FD"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone21:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7914D26B-CBD6-4846-9BD3-403708D69319"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone22:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "123C6285-03BE-49FC-B821-8BDB25D02863"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone23:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8A28C2E2-B7BC-46CE-94E4-AE3EF172AA47"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone24:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "069B0D8E-8223-4C4E-A834-C6235D6C3450"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone25:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E6282085-5716-4874-B0B0-180ECDEE128F"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F1F981F5-035A-4EDD-8A9F-481EE8BC7FF7"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone4:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "03A171AF-2EC8-4422-912C-547CDB58CAAA"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone5:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "538E68C4-0BA4-495F-AEF8-4EF6EE7963CF"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone6:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "49350A6E-5E1D-45B2-A874-3B8601B3ADCC"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone7:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5F50942F-DF54-46C0-8371-9A476DD3EEA3"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone8:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D12C2C95-B79F-4AA4-8CE3-99A3EE7991AB"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone9:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "98792138-DD56-42DF-9612-3BDC65EEC117"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.