TomcatWeb server / proxy · Apache
CVE-2025-31650
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedImproper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceApache Tomcat contains an improper input validation vulnerability in HTTP priority header parsing. When invalid priority headers are received, incorrect error handling fails to properly clean up the request resources, causing a memory leak. Attackers can exploit this by sending large numbers of malformed requests to exhaust memory and trigger an OutOfMemoryException (DoS).
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data
TomcatWeb server / proxy
>= 9.0.76, < 9.0.104>= 10.1.10, < 10.1.40>= 11.0.1, < 11.0.6= 11.0.0CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify installed Apache Tomcat versionCheck the version.sh script or the ServerInfo.properties file in the Tomcat lib directory, or look at the server startup banner for the exact version numberAffected if The version falls within >= 9.0.76 and < 9.0.104, >= 10.1.10 and < 10.1.40, >= 11.0.1 and < 11.0.6, or equals 11.0.0
-
Determine if HTTP/2 connector is enabledExamine the server.xml configuration file for any Connector elements with protocol="HTTP/1.1" that have upgrade protocols enabled, or check for explicit HTTP/2 connector configurationsAffected if HTTP/2 is enabled and accepting connections, as the priority header vulnerability exists in HTTP/2 request processing
-
Check for prior OutOfMemoryException errorsSearch Tomcat log files (catalina.out, localhost.log, or files in the logs directory) for OutOfMemoryException or java.lang.OutOfMemoryError entries occurring after periods of high request trafficAffected if OutOfMemoryError exceptions appear in logs, especially accompanied by messages about heap space exhaustion
-
Monitor current heap memory usageUse JMX, jstat, or the Tomcat manager application to observe current heap memory consumption, particularly the used versus max heap sizesAffected if Heap memory usage is abnormally high or continuously growing without typical GC patterns
You are affected if your Tomcat version is within the vulnerable ranges AND HTTP/2 connectors are enabled, with potential indicators being OutOfMemoryError exceptions in logs or abnormally high heap memory consumption.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped9.0.10410.1.4011.0.6
Upgrade Apache Tomcat to version 9.0.104, 10.1.40, or 11.0.6 (or 8.5.101+ if using 8.5) to patch the memory leak. For unpatched versions, consider rate-limiting or filtering invalid HTTP headers at a load balancer or WAF as a temporary workaround.
9.0.104 for Tomcat 9.x, 10.1.40 for Tomcat 10.1.x, or 11.0.6 for Tomcat 11.x
- Identify the currently installed Tomcat version (e.g., check CATALINA_HOME or version.sh)
- Determine the major version line (9.x, 10.1.x, or 11.x) in use
- Stop the Tomcat service or instance
- Backup the existing Tomcat installation directory, configuration files, and deployed applications
- Download the appropriate fixed version: 9.0.104 for 9.x line, 10.1.40 for 10.1.x line, or 11.0.6 for 11.x line from a trusted mirror (e.g., tomcat.apache.org)
- Extract the new Tomcat version to a staging location
- Review the new version's release notes for any breaking changes or required configuration updates
- Migrate custom configurations (server.xml, context.xml, etc.) from the old installation to the new one
Generated from the published advisory — verify against the referenced sources before acting.
Fix this in Tomcat
Scoped from the published advisory
- Consultation3.0 h
- Implementation8.0 h
- Testing6.0 h
- Review / QA3.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,568.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2025-31650 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2025-31650 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data