CVE-2025-31650
highpriority · attend · 61EPSS 0.613 · 99 %ileexploit · PoCDEEURUUSEPSS · scored 2026-10-22
Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedPIT User Authentication Servicepilz_psirt
Please visit the Pilz website (https://www.pilz.com/en-INT/search) and install the new version 'Software PIT User Auth. Service 1.4.1' on to your device.
- FixedPIT User Authentication Service 1.4.0pilz_psirt
Please visit the Pilz website (https://www.pilz.com/en-INT/search) and install the new version 'Software PIT User Auth. Service 1.4.1' on to your device.
- MitigationPIT User Authentication Servicepilz_psirt
Limit network access to the PITreader and PIT User Authentication Service by using a firewall, a host-based firewall or similar measures.
- MitigationPIT User Authentication Service 1.4.0pilz_psirt
Limit network access to the PITreader and PIT User Authentication Service by using a firewall, a host-based firewall or similar measures.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (7)
Public proof-of-concept and weaponised exploit code.
- EDB-52318Apache Tomcat 10.1.39 - Denial of Service (DoS)PoC · exploit_db
- B1gN0Se/Tomcat-CVE-2025-31650B1gN0Se/Tomcat-CVE-2025-31650PoC · poc_in_github
- assad12341/Dos-exploit-CVE-2025-31650PoC · poc_in_github
- obscura-cert/CVE-2025-31650obscura-cert/CVE-2025-31650PoC · poc_in_github
affected products (67)
Products and version ranges known to be affected.
advisories (9)
Vendor and ecosystem advisories describing this.
- PPSA-2026-001Pilz: Multiple Vulnerabilities affecting the PIT User Authentication Service2026-02-02csaf · pilz_psirtDE
**PIT User Authentication Service is part of the operating mode selection and access permission system PITmode.** The PIT User Authentication Service is affected by multiple vulnerabilities in included third-party components.
- WID-SEC-W-2025-0895Apache Tomcat: Mehrere SchwachstellenDeutsch2025-04-28csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Apache Tomcat ausnutzen, um einen Denial of Service Angriff durchzuführen, oder Sicherheitsvorkehrungen zu umgehen.
- WID-SEC-W-2025-1343Atlassian Bitbucket: Mehrere Schwachstellen ermöglichen Denial of ServiceDeutsch2025-06-17csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Atlassian Bitbucket ausnutzen, um einen Denial of Service Angriff durchzuführen.
- WID-SEC-W-2025-1365IBM QRadar SIEM: Mehrere SchwachstellenDeutsch2025-06-19csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, um beliebige Befehle auszuführen und um nicht näher spezifizierte Auswirkungen zu verursachen.
- WID-SEC-W-2025-1439Dell Secure Connect Gateway: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffDeutsch2025-06-30csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell Secure Connect Gateway ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
- WID-SEC-W-2025-1850Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffDeutsch2025-08-14csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
- WID-SEC-W-2026-0351Dell NetWorker (Third Party Components): Mehrere SchwachstellenDeutsch2026-02-09csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell NetWorker ausnutzen, um Angriffe zu starten, die die Integrität, Vertraulichkeit und Verfügbarkeit von Systemen beeinträchtigen.
- GHSA-3p2h-wqq4-wf4hApache Tomcat Denial of Service via invalid HTTP priority header2025-04-28ghsa · osvUS
Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.
- BIT-tomcat-2025-31650Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame2025-04-30vendor · osvUS
Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.
also known as (7)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2025/04/28/2cnnvd
- https://cxsecurity.com/issue/WLB-2025060008cnnvd
- https://cxsecurity.com/issue/WLB-2025060012cnnvd
- https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826cnnvd
- https://tomcat.apache.org/security-11.htmlPatchcnnvd
- https://vigilance.fr/vulnerability/Apache-Tomcat-memory-leak-via-Invalid-HTTP-Prioritization-Header-46981cnnvd
- https://www.exploit-db.com/exploits/52318cnnvd
- https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan