{"id":"CVE-2025-31650","published":"2025-04-28T19:14:31Z","modified":"2025-11-03T19:53:11Z","title":"Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame","vendor":"Apache Software Foundation","product":"Apache Tomcat","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[">= 9.0.76, <= 9.0.102",">= 10.1.10, <= 10.1.39",">= 11.0.0-M2, <= 11.0.5",">= 8.5.90, <= 8.5.100"]}],"description":{"text":"Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.\n\nThis issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.90 though 8.5.100.\n\n\nUsers are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.","provenance":"source","from":"CVE.org"},"summary":{"text":"Apache Tomcat contains an improper input validation flaw in its HTTP/2 handling, where malformed priority headers (PRIORITY_UPDATE frames) are not fully cleaned up after the request fails, leaking memory. An unauthenticated remote attacker with network access can send a large number of such requests, without any user interaction or special configuration, to exhaust memory and cause a denial of service.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:01Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.61322,"percentile":0.99162,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":1,"pulses":[{"name":"Actualización Oracle update - 20/07/2025","url":"https://otx.alienvault.com/pulse/687d031c402a7679a4673a5d","created":"2025-07-20"}],"provenance":"machine"},"cwes":[{"id":"CWE-459","name":"Incomplete Cleanup"}],"references":[{"url":"https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2025/04/28/2","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","vulnerableRanges":[">=9.0.76, <9.0.104",">=10.1.10, <10.1.40",">=11.0.0-M2, <11.0.6",">=8.5.0, <=8.5.100"],"patched":["9.0.104","10.1.40","11.0.6"],"from":["GHSA-3p2h-wqq4-wf4h"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=9.0.76, <9.0.104",">=10.1.10, <10.1.40",">=11.0.0-M2, <11.0.6",">=8.5.0, <=8.5.100"],"patched":["9.0.104","10.1.40","11.0.6"],"from":["GHSA-3p2h-wqq4-wf4h"],"provenance":"source"}],"advisories":[{"id":"GHSA-3p2h-wqq4-wf4h","url":"https://github.com/advisories/GHSA-3p2h-wqq4-wf4h","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","vulnerableRanges":[">=9.0.76, <9.0.104"],"patched":["9.0.104"],"provenance":"source","from":"GHSA"},{"id":"GHSA-3p2h-wqq4-wf4h","url":"https://github.com/advisories/GHSA-3p2h-wqq4-wf4h","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","vulnerableRanges":[">=10.1.10, <10.1.40"],"patched":["10.1.40"],"provenance":"source","from":"GHSA"},{"id":"GHSA-3p2h-wqq4-wf4h","url":"https://github.com/advisories/GHSA-3p2h-wqq4-wf4h","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","vulnerableRanges":[">=11.0.0-M2, <11.0.6"],"patched":["11.0.6"],"provenance":"source","from":"GHSA"},{"id":"GHSA-3p2h-wqq4-wf4h","url":"https://github.com/advisories/GHSA-3p2h-wqq4-wf4h","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=9.0.76, <9.0.104"],"patched":["9.0.104"],"provenance":"source","from":"GHSA"},{"id":"GHSA-3p2h-wqq4-wf4h","url":"https://github.com/advisories/GHSA-3p2h-wqq4-wf4h","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=10.1.10, <10.1.40"],"patched":["10.1.40"],"provenance":"source","from":"GHSA"},{"id":"GHSA-3p2h-wqq4-wf4h","url":"https://github.com/advisories/GHSA-3p2h-wqq4-wf4h","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=11.0.0-M2, <11.0.6"],"patched":["11.0.6"],"provenance":"source","from":"GHSA"},{"id":"GHSA-3p2h-wqq4-wf4h","url":"https://github.com/advisories/GHSA-3p2h-wqq4-wf4h","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","vulnerableRanges":[">=8.5.0, <=8.5.100"],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-3p2h-wqq4-wf4h","url":"https://github.com/advisories/GHSA-3p2h-wqq4-wf4h","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=8.5.0, <=8.5.100"],"patched":[],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2025-13627","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-13627","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":52318,"url":"https://www.exploit-db.com/exploits/52318","title":"Apache Tomcat 10.1.39 - Denial of Service (DoS)","type":"remote","platform":"multiple","date":"2025-06-05","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2025-06-05"},"pocGithub":{"count":3,"skipped":3,"earliest":"2025-04-30","earliestUrl":"https://github.com/absholi7ly/TomcatKiller-CVE-2025-31650","repos":[{"name":"absholi7ly/TomcatKiller-CVE-2025-31650","url":"https://github.com/absholi7ly/TomcatKiller-CVE-2025-31650","stars":21,"created":"2025-04-30"},{"name":"tunahantekeoglu/CVE-2025-31650","url":"https://github.com/tunahantekeoglu/CVE-2025-31650","stars":2,"created":"2025-04-30"},{"name":"assad12341/Dos-exploit-","url":"https://github.com/assad12341/Dos-exploit-","stars":0,"created":"2025-06-13"}]},"first":{"date":"2025-04-30","source":"PoC-in-GitHub","url":"https://github.com/absholi7ly/TomcatKiller-CVE-2025-31650"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-04-28","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-31650","provenance":"source"},{"date":"2025-04-30","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2025-06-05","url":"https://github.com/absholi7ly/TomcatKiller-CVE-2025-31650","provenance":"source"}],"speed":{"daysToPublicExploit":2,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":30.8,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.83,"detail":"percentile 0.9916"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 3 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-apache-tomcat-cve-2017-7675","parents":[{"from":"CVE-2017-7675","to":"CVE-2025-31650","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/coyote/http2/Stream.java"],"commits":["https://github.com/apache/tomcat/commit/cf181edc9a8c239cde704cffc3c503425bdcae2b","https://github.com/apache/tomcat/commit/dacb030b85fe0e0b3da87469e23d0f31252fdede","https://github.com/apache/tomcat/commit/1eef1dc459c45f1e421d8bd25ef340fc1cc34edc","https://github.com/apache/tomcat/commit/40ae788c2e64d018b4e58cd4210bb96434d0100d"],"basis":"shared function","functions":["emitHeader"]}]},{"from":"CVE-2024-24549","to":"CVE-2025-31650","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/coyote/http2/Http2Parser.java"],"commits":["https://github.com/apache/tomcat/commit/0cac540a882220231ba7a82330483cbd5f6b1f96","https://github.com/apache/tomcat/commit/810f49d5ff6d64b704af85d5b8d0aab9ec3c83f5","https://github.com/apache/tomcat/commit/1eef1dc459c45f1e421d8bd25ef340fc1cc34edc","https://github.com/apache/tomcat/commit/40ae788c2e64d018b4e58cd4210bb96434d0100d"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2025-52434","published":"2025-07-10","fixed":"9.0.107","kev":false,"link":{"from":"CVE-2025-31650","to":"CVE-2025-52434","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-coyote","fromFixed":"9.0.104","toFixed":"9.0.107","daysApart":73}]}},{"cve":"CVE-2024-38286","published":"2024-11-07","fixed":"11.0.0-M21","kev":false},{"cve":"CVE-2023-24998","published":"2023-02-20","fixed":"11.0.0-M5","kev":false},{"cve":"CVE-2024-52317","published":"2024-11-18","fixed":"11.0.0","kev":false,"link":{"from":"CVE-2024-52317","to":"CVE-2025-31650","relation":"successor","confidence":"high","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-coyote","fromFixed":"9.0.96","toFixed":"9.0.104","daysApart":161},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-coyote","fromFixed":"10.1.31","toFixed":"10.1.40","daysApart":161},{"kind":"same-code","provenance":"machine","files":["java/org/apache/coyote/http2/Stream.java"],"commits":["https://github.com/apache/tomcat/commit/146f94f87ea398fb592c7a20a5ccbef95e9dd72b","https://github.com/apache/tomcat/commit/47307ee27abcdea2ee40e33897aca760083de46a","https://github.com/apache/tomcat/commit/1eef1dc459c45f1e421d8bd25ef340fc1cc34edc","https://github.com/apache/tomcat/commit/40ae788c2e64d018b4e58cd4210bb96434d0100d"],"basis":"shared file"}]}},{"cve":"CVE-2025-31650","published":"2025-04-28","fixed":"11.0.6","kev":false},{"cve":"CVE-2025-53506","published":"2025-07-10","fixed":"11.0.9","kev":false,"link":{"from":"CVE-2025-31650","to":"CVE-2025-53506","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-coyote","fromFixed":"9.0.104","toFixed":"9.0.107","daysApart":73},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-coyote","fromFixed":"10.1.40","toFixed":"10.1.43","daysApart":73}]}},{"cve":"CVE-2025-48989","published":"2025-08-13","fixed":"11.0.10","kev":false},{"cve":"CVE-2025-66614","published":"2026-02-17","fixed":"11.0.15","kev":false}],"package":"Maven:org.apache.tomcat:tomcat-coyote"}}