CVE-2025-31650

Summary

CVE-2025-31650 is an Input Validation vulnerability affecting various versions of Apache Tomcat. The flaw arises from the server's improper handling of certain invalid HTTP priority headers. This issue leads to incomplete cleaning up of failed requests, creating a memory leak. A high volume of such requests may eventually cause an Out-of-Memory Exception, inducing a Denial of Service condition. Affected versions include 9.0.76 through 9.0.102, 10.1.10 through 10.1.39, and 11.0.0-M2 through 11.0.5. To mitigate this risk, users are advised to upgrade to the patched versions 9.0.104, 10.1.40, or 11.0.6.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.