CVE-2025-31650

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-31650
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-31650.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-31650
Aliases
Downstream
CGA (16)
CLEANSTART (4)
CLSA (6)
DEBIAN (1)
MGASA (1)
MINI (3)
OESA (1)
openSUSE (2)
RHSA (8)
RLSA (3)
ROOT (1)
SUSE (4)
UBUNTU (1)
Related
ALSA (3)
CGA (1)
openSUSE (2)
SUSE (4)
Published
2025-04-28T19:14:31Z
Modified
2026-08-12T03:51:15Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame
Details

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.

This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100.

Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.

Database specific 
{
    "cna_assigner":  "apache",
    "cwe_ids":  [
        "CWE-459"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31650.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "9.0.76"
                },
                {
                    "last_affected":  "9.0.102"
                },
                {
                    "introduced":  "10.1.10"
                },
                {
                    "last_affected":  "10.1.39"
                },
                {
                    "introduced":  "11.0.0-M2"
                },
                {
                    "last_affected":  "11.0.5"
                },
                {
                    "introduced":  "8.5.90"
                },
                {
                    "last_affected":  "8.5.100"
                }
            ],
            "source":  "AFFECTED_FIELD"
        },
        {
            "extracted_events":  [
                {
                    "introduced":  "9.0.76"
                },
                {
                    "fixed":  "9.0.102"
                },
                {
                    "introduced":  "10.1.10"
                },
                {
                    "fixed":  "10.1.39"
                },
                {
                    "introduced":  "11.0.0-M2"
                },
                {
                    "fixed":  "11.0.5"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}
References

Affected packages

Git / github.com/apache/tomcat

Affected ranges

Type
GIT
Repo
https://github.com/apache/tomcat
Events
Introduced
ff0629ca2bd82d6bff5245c02b42d932149df34d
Fixed
f8cfae0a0d1c8dc592099a1430cd08e352430823
Introduced
744f57269b2dda2dfcd252fff7f04744a7fcd5b8
Fixed
1ee4bc9109d48cd062d1bc1a4c002358e03455e9
Introduced
6c56147c3966fde5ae34aab2b253593e8700a28c
Fixed
872451298e20bb77ea95c499e6866b1e32b337e0
Introduced
06d0e42e6cd70aae860f164c27d16bdfdfcdc496
Last Affected
de714a23642a4d0baef342db6762a7f7a550d82c
Database specific
Show details 
{
    "cpe":  [
        "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone10:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone11:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone12:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone13:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone14:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone15:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone16:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone17:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone18:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone19:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone20:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone21:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone22:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone23:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone24:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone25:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone3:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone4:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone5:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone6:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone7:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone8:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone9:*:*:*:*:*:*"
    ],
    "extracted_events":  [
        {
            "introduced":  "9.0.76"
        },
        {
            "fixed":  "9.0.104"
        },
        {
            "introduced":  "10.1.10"
        },
        {
            "fixed":  "10.1.40"
        },
        {
            "introduced":  "11.0.1"
        },
        {
            "fixed":  "11.0.6"
        },
        {
            "introduced":  "11.0.0-milestone10"
        },
        {
            "last_affected":  "11.0.0-milestone10"
        },
        {
            "introduced":  "11.0.0-milestone11"
        },
        {
            "last_affected":  "11.0.0-milestone11"
        },
        {
            "introduced":  "11.0.0-milestone12"
        },
        {
            "last_affected":  "11.0.0-milestone12"
        },
        {
            "introduced":  "11.0.0-milestone13"
        },
        {
            "last_affected":  "11.0.0-milestone13"
        },
        {
            "introduced":  "11.0.0-milestone14"
        },
        {
            "last_affected":  "11.0.0-milestone14"
        },
        {
            "introduced":  "11.0.0-milestone15"
        },
        {
            "last_affected":  "11.0.0-milestone15"
        },
        {
            "introduced":  "11.0.0-milestone16"
        },
        {
            "last_affected":  "11.0.0-milestone16"
        },
        {
            "introduced":  "11.0.0-milestone17"
        },
        {
            "last_affected":  "11.0.0-milestone17"
        },
        {
            "introduced":  "11.0.0-milestone18"
        },
        {
            "last_affected":  "11.0.0-milestone18"
        },
        {
            "introduced":  "11.0.0-milestone19"
        },
        {
            "last_affected":  "11.0.0-milestone19"
        },
        {
            "introduced":  "11.0.0-milestone2"
        },
        {
            "last_affected":  "11.0.0-milestone2"
        },
        {
            "introduced":  "11.0.0-milestone20"
        },
        {
            "last_affected":  "11.0.0-milestone20"
        },
        {
            "introduced":  "11.0.0-milestone21"
        },
        {
            "last_affected":  "11.0.0-milestone21"
        },
        {
            "introduced":  "11.0.0-milestone22"
        },
        {
            "last_affected":  "11.0.0-milestone22"
        },
        {
            "introduced":  "11.0.0-milestone23"
        },
        {
            "last_affected":  "11.0.0-milestone23"
        },
        {
            "introduced":  "11.0.0-milestone24"
        },
        {
            "last_affected":  "11.0.0-milestone24"
        },
        {
            "introduced":  "11.0.0-milestone25"
        },
        {
            "last_affected":  "11.0.0-milestone25"
        },
        {
            "introduced":  "11.0.0-milestone3"
        },
        {
            "last_affected":  "11.0.0-milestone3"
        },
        {
            "introduced":  "11.0.0-milestone4"
        },
        {
            "last_affected":  "11.0.0-milestone4"
        },
        {
            "introduced":  "11.0.0-milestone5"
        },
        {
            "last_affected":  "11.0.0-milestone5"
        },
        {
            "introduced":  "11.0.0-milestone6"
        },
        {
            "last_affected":  "11.0.0-milestone6"
        },
        {
            "introduced":  "11.0.0-milestone7"
        },
        {
            "last_affected":  "11.0.0-milestone7"
        },
        {
            "introduced":  "11.0.0-milestone8"
        },
        {
            "last_affected":  "11.0.0-milestone8"
        },
        {
            "introduced":  "11.0.0-milestone9"
        },
        {
            "last_affected":  "11.0.0-milestone9"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

11.*
11.0.0-milestone10
11.0.0-milestone11
11.0.0-milestone12
11.0.0-milestone13
11.0.0-milestone14
11.0.0-milestone15
11.0.0-milestone16
11.0.0-milestone17
11.0.0-milestone18
11.0.0-milestone19
11.0.0-milestone2
11.0.0-milestone20
11.0.0-milestone21
11.0.0-milestone22
11.0.0-milestone23
11.0.0-milestone24
11.0.0-milestone25
11.0.0-milestone3
11.0.0-milestone4
11.0.0-milestone5
11.0.0-milestone6
11.0.0-milestone7
11.0.0-milestone8
11.0.0-milestone9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-31650.json"