GHSA-3p2h-wqq4-wf4h

Suggest an improvement
Source
https://github.com/advisories/GHSA-3p2h-wqq4-wf4h
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-3p2h-wqq4-wf4h/GHSA-3p2h-wqq4-wf4h.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-3p2h-wqq4-wf4h
Aliases
Published
2025-04-28T21:30:43Z
Modified
2025-05-06T18:31:37.349048Z
Severity
  • 6.6 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U CVSS Calculator
Summary
Apache Tomcat Denial of Service via invalid HTTP priority header
Details

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.

This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.

Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.

Database specific 
{
    "nvd_published_at": "2025-04-28T20:15:20Z",
    "cwe_ids": [
        "CWE-459",
        "CWE-460"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-29T14:59:22Z"
}
References

Affected packages

Maven / org.apache.tomcat:tomcat-coyote

Package

Name
org.apache.tomcat:tomcat-coyote
View open source insights on deps.dev
Purl
pkg:maven/org.apache.tomcat/tomcat-coyote

Affected ranges

Type
ECOSYSTEM
Events
Introduced
9.0.76
Fixed
9.0.104

Affected versions

9.*

9.0.76
9.0.78
9.0.79
9.0.80
9.0.81
9.0.82
9.0.83
9.0.84
9.0.85
9.0.86
9.0.87
9.0.88
9.0.89
9.0.90
9.0.91
9.0.93
9.0.94
9.0.95
9.0.96
9.0.97
9.0.98
9.0.99
9.0.100
9.0.102

Database specific 

{
    "last_known_affected_version_range": "<= 9.0.102"
}

Maven / org.apache.tomcat:tomcat-coyote

Package

Name
org.apache.tomcat:tomcat-coyote
View open source insights on deps.dev
Purl
pkg:maven/org.apache.tomcat/tomcat-coyote

Affected ranges

Type
ECOSYSTEM
Events
Introduced
10.1.10
Fixed
10.1.40

Affected versions

10.*

10.1.10
10.1.11
10.1.12
10.1.13
10.1.14
10.1.15
10.1.16
10.1.17
10.1.18
10.1.19
10.1.20
10.1.23
10.1.24
10.1.25
10.1.26
10.1.28
10.1.29
10.1.30
10.1.31
10.1.33
10.1.34
10.1.35
10.1.36
10.1.39

Maven / org.apache.tomcat:tomcat-coyote

Package

Name
org.apache.tomcat:tomcat-coyote
View open source insights on deps.dev
Purl
pkg:maven/org.apache.tomcat/tomcat-coyote

Affected ranges

Type
ECOSYSTEM
Events
Introduced
11.0.0-M2
Fixed
11.0.6

Affected versions

11.*

11.0.0-M3
11.0.0-M4
11.0.0-M5
11.0.0-M6
11.0.0-M7
11.0.0-M9
11.0.0-M10
11.0.0-M11
11.0.0-M12
11.0.0-M13
11.0.0-M14
11.0.0-M15
11.0.0-M16
11.0.0-M17
11.0.0-M18
11.0.0-M19
11.0.0-M20
11.0.0-M21
11.0.0-M22
11.0.0-M24
11.0.0-M25
11.0.0-M26
11.0.0
11.0.1
11.0.2
11.0.3
11.0.4
11.0.5