CVE-2025-31650

Description

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.

Reserved 2025-03-31 | Published 2025-04-28 | Updated 2025-05-06 | Assigner apache

Problem types

CWE-459 Incomplete Cleanup

Product status

Default status
unaffected

9.0.76
affected

10.1.10
affected

11.0.0-M2
affected

References

lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826 vendor-advisory

cve.org (CVE-2025-31650)

nvd.nist.gov (CVE-2025-31650)

Download JSON