CVE-2025-31650: Apache Tomcat Denial of Service Vulnerability

Q: What is CVE-2025-31650?

CVE-2025-31650 is a security vulnerability in Apache Tomcat involving Apache Tomcat Denial of Service via invalid HTTP priority header under CWE-459: Incomplete Cleanup.

Q: Which Apache Tomcat versions are affected?

Affected versions include releases prior to 9.0.104, 10.1.40, 11.0.6 across affected packages: org.apache.tomcat:tomcat-coyote, org.apache.tomcat.embed:tomcat-embed-core.

Q: What version fixes CVE-2025-31650?

Upgrading to 9.0.104, 10.1.40, 11.0.6 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is tomcat-coyote affected?

Yes, org.apache.tomcat:tomcat-coyote is affected in releases prior to 9.0.104, 10.1.40, 11.0.6, Latest secure release. Upgrade your dependency to 9.0.104, 10.1.40, 11.0.6, Latest secure release or later.

Q: Is tomcat-embed-core affected?

Yes, org.apache.tomcat.embed:tomcat-embed-core is affected in releases prior to 9.0.104, 10.1.40, 11.0.6, Latest secure release. Upgrade your dependency to 9.0.104, 10.1.40, 11.0.6, Latest secure release or later.

Q: What CWE is associated with CVE-2025-31650?

CVE-2025-31650 is classified under CWE-459: Incomplete Cleanup (The product does not properly "clean up" and remove temporary or supporting resources after they have been used.).

Q: How can I check Maven dependencies for CVE-2025-31650?

Run the dependency tree command: 'mvn dependency:tree -Dincludes=org.apache.tomcat'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

MODERATE

Advisory Identifier: GHSA-3p2h-wqq4-wf4h

CWE-459 CWE-460

Published 2025-04-28

Advisory Summary

CVE-2025-31650 is a MODERATE denial of service vulnerability (CWE-459: Incomplete Cleanup) affecting Apache Tomcat libraries in the Maven ecosystem. The issue involves apache tomcat denial of service via invalid http priority header. Remediation is available by upgrading affected packages to version 9.0.104, 10.1.40, 11.0.6.

CVE-2025-31650 at a Glance

CVE Identifier CVE-2025-31650

GHSA Identifier GHSA-3p2h-wqq4-wf4h

Severity MODERATE

CVSS v3.1 Base Score N/A

CWE Classification CWE-459: Incomplete Cleanup

Affected Product Apache Tomcat

Package Ecosystem Maven

Published Date 2025-04-28

Last Updated 2025-11-03

How to Fix CVE-2025-31650

To remediate this vulnerability, upgrade all affected Apache Tomcat dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

org.apache.tomcat:tomcat-coyote fixed: 9.0.104

<dependency>
    <groupId>org.apache.tomcat</groupId>
    <artifactId>tomcat-coyote</artifactId>
    <version>9.0.104</version>
</dependency>

org.apache.tomcat:tomcat-coyote fixed: 10.1.40

<dependency>
    <groupId>org.apache.tomcat</groupId>
    <artifactId>tomcat-coyote</artifactId>
    <version>10.1.40</version>
</dependency>

org.apache.tomcat:tomcat-coyote fixed: 11.0.6

<dependency>
    <groupId>org.apache.tomcat</groupId>
    <artifactId>tomcat-coyote</artifactId>
    <version>11.0.6</version>
</dependency>

org.apache.tomcat.embed:tomcat-embed-core fixed: 9.0.104

<dependency>
    <groupId>org.apache.tomcat.embed</groupId>
    <artifactId>tomcat-embed-core</artifactId>
    <version>9.0.104</version>
</dependency>

org.apache.tomcat.embed:tomcat-embed-core fixed: 10.1.40

<dependency>
    <groupId>org.apache.tomcat.embed</groupId>
    <artifactId>tomcat-embed-core</artifactId>
    <version>10.1.40</version>
</dependency>

org.apache.tomcat.embed:tomcat-embed-core fixed: 11.0.6

<dependency>
    <groupId>org.apache.tomcat.embed</groupId>
    <artifactId>tomcat-embed-core</artifactId>
    <version>11.0.6</version>
</dependency>

org.apache.tomcat:tomcat-coyote fixed: Latest secure release

<dependency>
    <groupId>org.apache.tomcat</groupId>
    <artifactId>tomcat-coyote</artifactId>
    <version>Latest secure release</version>
</dependency>

org.apache.tomcat.embed:tomcat-embed-core fixed: Latest secure release

<dependency>
    <groupId>org.apache.tomcat.embed</groupId>
    <artifactId>tomcat-embed-core</artifactId>
    <version>Latest secure release</version>
</dependency>

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

mvn dependency:tree -Dincludes=org.apache.tomcat

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2025-31650, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree -Dincludes=org.apache.tomcat

Analyze the terminal output to locate any version of Apache Tomcat in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 9.0.104), your application is affected.

Note: The mvn dependency:tree -Dincludes=org.apache.tomcat command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-459: Incomplete Cleanup, where the product does not properly "clean up" and remove temporary or supporting resources after they have been used. In Apache Tomcat, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.

CVE-2025-31650 Affected Apache Tomcat Versions

8 component(s)

Fixed Versions:

9.0.10410.1.4011.0.6

Product / Package	Ecosystem	Affected Versions	Fixed Version
org.apache.tomcat:tomcat-coyote maven/org.apache.tomcat/tomcat-coyote	Maven	≥ 9.0.76 < 9.0.104	9.0.104
org.apache.tomcat:tomcat-coyote maven/org.apache.tomcat/tomcat-coyote	Maven	≥ 10.1.10 < 10.1.40	10.1.40
org.apache.tomcat:tomcat-coyote maven/org.apache.tomcat/tomcat-coyote	Maven	≥ 11.0.0-M2 < 11.0.6	11.0.6
org.apache.tomcat.embed:tomcat-embed-core maven/org.apache.tomcat.embed/tomcat-embed-core	Maven	≥ 9.0.76 < 9.0.104	9.0.104
org.apache.tomcat.embed:tomcat-embed-core maven/org.apache.tomcat.embed/tomcat-embed-core	Maven	≥ 10.1.10 < 10.1.40	10.1.40
org.apache.tomcat.embed:tomcat-embed-core maven/org.apache.tomcat.embed/tomcat-embed-core	Maven	≥ 11.0.0-M2 < 11.0.6	11.0.6
org.apache.tomcat:tomcat-coyote maven/org.apache.tomcat/tomcat-coyote	Maven	≥ 8.5.0 ≤ 8.5.100
org.apache.tomcat.embed:tomcat-embed-core maven/org.apache.tomcat.embed/tomcat-embed-core	Maven	≥ 8.5.0 ≤ 8.5.100

References

NVD — CVE-2025-31650 NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-31650

Security Fix Commit FIX COMMIT

https://github.com/apache/tomcat/commit/1eef1dc459c45f1e421d8bd25ef340fc1cc34edc

Security Fix Commit FIX COMMIT

https://github.com/apache/tomcat/commit/40ae788c2e64d018b4e58cd4210bb96434d0100d

Security Fix Commit FIX COMMIT

https://github.com/apache/tomcat/commit/75554da2fc5574862510ae6f0d7b3d78937f1d40

Security Fix Commit FIX COMMIT

https://github.com/apache/tomcat/commit/8cc3b8fb3f2d8d4d6a757e014f19d1fafa948a60

Security Fix Commit FIX COMMIT

https://github.com/apache/tomcat/commit/b7674782679e1514a0d154166b1d04d38aaac4a9

Security Fix Commit FIX COMMIT

https://github.com/apache/tomcat/commit/b98e74f517b36929f4208506e5adad22cb767baa

Security Fix Commit FIX COMMIT

https://github.com/apache/tomcat/commit/cba1a0fe1289ee7f5dd46c61c38d1e1ac5437bff

Security Fix Commit FIX COMMIT

https://github.com/apache/tomcat/commit/ded0285b96b4d3f5560dfc8856ad5ec4a9b50ba9

Security Fix Commit FIX COMMIT

https://github.com/apache/tomcat/commit/f619e6a05029538886d5a9d987925d573b5bb8c2

Apache Tomcat Source Repository REPOSITORY

https://github.com/apache/tomcat

lists.apache.org/thread/j6zzk0y3yym9... WEB

https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826

lists.debian.org/debian-lts-announce... WEB

https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html

Apache Tomcat Security Information SECURITY

https://tomcat.apache.org/security-10.html

Apache Tomcat Security Information SECURITY

https://tomcat.apache.org/security-11.html

Apache Tomcat Security Information SECURITY

https://tomcat.apache.org/security-9.html

Apache Tomcat Security Information SECURITY

http://www.openwall.com/lists/oss-security/2025/04/28/2

Frequently Asked Questions

What is CVE-2025-31650?

CVE-2025-31650 is a security vulnerability in Apache Tomcat involving Apache Tomcat Denial of Service via invalid HTTP priority header under CWE-459: Incomplete Cleanup.

Which Apache Tomcat versions are affected?

Affected versions include releases prior to 9.0.104, 10.1.40, 11.0.6 across affected packages: org.apache.tomcat:tomcat-coyote, org.apache.tomcat.embed:tomcat-embed-core.

What version fixes CVE-2025-31650?

Upgrading to 9.0.104, 10.1.40, 11.0.6 (or the latest patched release for your respective branch) resolves the vulnerability.

Is tomcat-coyote affected?

Yes, org.apache.tomcat:tomcat-coyote is affected in releases prior to 9.0.104, 10.1.40, 11.0.6, Latest secure release. Upgrade your dependency to 9.0.104, 10.1.40, 11.0.6, Latest secure release or later.

Is tomcat-embed-core affected?

Yes, org.apache.tomcat.embed:tomcat-embed-core is affected in releases prior to 9.0.104, 10.1.40, 11.0.6, Latest secure release. Upgrade your dependency to 9.0.104, 10.1.40, 11.0.6, Latest secure release or later.

What CWE is associated with CVE-2025-31650?

CVE-2025-31650 is classified under CWE-459: Incomplete Cleanup (The product does not properly "clean up" and remove temporary or supporting resources after they have been used.).

How can I check Maven dependencies for CVE-2025-31650?

Run the dependency tree command: 'mvn dependency:tree -Dincludes=org.apache.tomcat'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-3p2h-wqq4-wf4h",
  "modified" : "2025-11-03T22:55:48Z",
  "published" : "2025-04-28T21:30:43Z",
  "aliases" : [ "CVE-2025-31650" ],
  "summary" : "Apache Tomcat Denial of Service via invalid HTTP priority header",
  "details" : "Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.\n\nThis issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100.\n\nUsers are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.tomcat:tomcat-coyote"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "9.0.76"
      }, {
        "fixed" : "9.0.104"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 9.0.102"
    }
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.tomcat:tomcat-coyote"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "10.1.10"
      }, {
        "fixed" : "10.1.40"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.tomcat:tomcat-coyote"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "11.0.0-M2"
      }, {
        "fixed" : "11.0.6"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.tomcat.embed:tomcat-embed-core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "9.0.76"
      }, {
        "fixed" : "9.0.104"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 9.0.102"
    }
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.tomcat.embed:tomcat-embed-core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "10.1.10"
      }, {
        "fixed" : "10.1.40"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.tomcat.embed:tomcat-embed-core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "11.0.0-M2"
      }, {
        "fixed" : "11.0.6"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.tomcat:tomcat-coyote"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "8.5.0"
      }, {
        "last_affected" : "8.5.100"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.tomcat.embed:tomcat-embed-core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "8.5.0"
      }, {
        "last_affected" : "8.5.100"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-31650"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/1eef1dc459c45f1e421d8bd25ef340fc1cc34edc"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/40ae788c2e64d018b4e58cd4210bb96434d0100d"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/75554da2fc5574862510ae6f0d7b3d78937f1d40"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/8cc3b8fb3f2d8d4d6a757e014f19d1fafa948a60"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/b7674782679e1514a0d154166b1d04d38aaac4a9"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/b98e74f517b36929f4208506e5adad22cb767baa"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/cba1a0fe1289ee7f5dd46c61c38d1e1ac5437bff"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/ded0285b96b4d3f5560dfc8856ad5ec4a9b50ba9"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/f619e6a05029538886d5a9d987925d573b5bb8c2"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/apache/tomcat"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"
  }, {
    "type" : "WEB",
    "url" : "https://tomcat.apache.org/security-10.html"
  }, {
    "type" : "WEB",
    "url" : "https://tomcat.apache.org/security-11.html"
  }, {
    "type" : "WEB",
    "url" : "https://tomcat.apache.org/security-9.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2025/04/28/2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-459", "CWE-460" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-04-29T14:59:22Z",
    "nvd_published_at" : "2025-04-28T20:15:20Z"
  }
}

CVSS V4

N/A MODERATE

Attack Vector N/A

Attack Complexity N/A

Privileges Required N/A

User Interaction N/A

Scope N/A

Confidentiality N/A

Integrity N/A

Availability N/A

Vector String

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

Advisory Metadata

Source ID: GHSA-3p2h-wqq4-wf4h
Schema Version: 1.4.0
Published: 2025-04-28 21:30
Last Modified: 2025-11-03 22:55
Database Record File: advisories/github-reviewed/2025/04/GHSA-3p2h-wqq4-wf4h/GHSA-3p2h-wqq4-wf4h.json