CVE-2025-31650: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 61.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-04-28 · updated 2026-06-17
Weakness: CWE-459

Description

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.

Affected products

Apache Tomcat: from 9.0.76 before 9.0.104; from 10.1.10 before 10.1.40; from 11.0.1 before 11.0.6; 11.0.0-milestone10, 11.0.0-milestone11, 11.0.0-milestone12, 11.0.0-milestone13, 11.0.0-milestone14, 11.0.0-milestone15 (+18) — fixed in 10.1.40, 11.0.6, 9.0.104

How to fix

Upgrade to a fixed version: Apache Tomcat 10.1.40, 11.0.6, 9.0.104. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-31650 or the next vulnerability affects your stack