CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2025-31650
High (7.5) in apache tomcat. EPSS 61% chance of exploitation in the next 30 days. Fixed in org.apache.tomcat:tomcat-coyote 10.1.40, 11.0.6, 9.0.104.
Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.
This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.90 though 8.5.100.
Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.
Severity
- EPSS
- 61% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWE
- CWE-459
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:tomcat
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3p2h-wqq4-wf4h | Maven | org.apache.tomcat:tomcat-coyote | >=9.0.76 <9.0.104 | 9.0.104 |
| GHSA-3p2h-wqq4-wf4h | Maven | org.apache.tomcat:tomcat-coyote | >=10.1.10 <10.1.40 | 10.1.40 |
| GHSA-3p2h-wqq4-wf4h | Maven | org.apache.tomcat:tomcat-coyote | >=11.0.0-M2 <11.0.6 | 11.0.6 |
| GHSA-3p2h-wqq4-wf4h | Maven | org.apache.tomcat.embed:tomcat-embed-core | >=9.0.76 <9.0.104 | 9.0.104 |
| GHSA-3p2h-wqq4-wf4h | Maven | org.apache.tomcat.embed:tomcat-embed-core | >=10.1.10 <10.1.40 | 10.1.40 |
| GHSA-3p2h-wqq4-wf4h | Maven | org.apache.tomcat.embed:tomcat-embed-core | >=11.0.0-M2 <11.0.6 | 11.0.6 |
| GHSA-3p2h-wqq4-wf4h | Maven | org.apache.tomcat:tomcat-coyote | >=8.5.0 <=8.5.100 | no fix published |
| GHSA-3p2h-wqq4-wf4h | Maven | org.apache.tomcat.embed:tomcat-embed-core | >=8.5.0 <=8.5.100 | no fix published |