CVE-2025-31650: Apache Tomcat

High severity, CVSS 7.5. EPSS: 61.3% chance of exploitation in the next 30 days.

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.

Affected products

• Apache Tomcat: from 9.0.76, before 9.0.104 (fixed in 9.0.104); from 10.1.10, before 10.1.40 (fixed in 10.1.40); from 11.0.1, before 11.0.6 (fixed in 11.0.6); version 11.0.0 only

Published 2025-04-28. Last modified 2026-06-17.