Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame
Apache Software Foundation · Apache Tomcat
Apache Tomcat contains an improper input validation flaw in its HTTP/2 handling, where malformed priority headers (PRIORITY_UPDATE frames) are not fully cleaned up after the request fails, leaking memory. An unauthenticated remote attacker with network access can send a large number of such requests, without any user interaction or special configuration, to exhaust memory and cause a denial of service.
Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Public exploit code (PoC-in-GitHub) appeared 2 days after disclosure. No confirmed exploitation is recorded.
- Disclosedday 0
- Public exploit codePoC-in-GitHub+2 days
Patch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
See the family tree8 related vulnerabilities in the same code over 8 years. The latest fix listed for tomcat-coyote is 11.0.15.
Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.
- same family
relatedMedium
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
- Same code patched: Http2UpgradeHandler.java (machine-matched)Functions: headersStartcommit 9434a44commit 9a02316commit 1bbc650commit 5591143
relatedMedium
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
- Same code patched: Http2Parser.java (machine-matched)commit 1bbc650commit 5591143commit 0cac540commit 810f49d
Next fix in the same packageLow
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
- Fixed one release later9.0.86 → 9.0.90 (org.apache.tomcat.embed:tomcat-embed-core)
- Fixed one release later10.1.19 → 10.1.25 (org.apache.tomcat.embed:tomcat-embed-core)
relatedMedium
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
- Same code patched: Stream.java (machine-matched)Functions: Streamcommit 2344a4ccommit 2afae30commit 146f94fcommit 47307ee
Next fix in the same packageHigh
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
- Fixed one release later9.0.96 → 9.0.104 (org.apache.tomcat:tomcat-coyote)
- Fixed one release later10.1.31 → 10.1.40 (org.apache.tomcat:tomcat-coyote)
- Same code patched: Stream.java (machine-matched)commit 146f94fcommit 47307eecommit 1eef1dccommit 40ae788
This CVECVE-2025-31650Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame28 Apr 2025- same family
Fixes in tomcat-coyoteMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.
- 9.0.107CVE-2025-5243410 Jul 2025
- 11.0.0-M5CVE-2023-2499820 Feb 2023
- 11.0.0-M21CVE-2024-382867 Nov 2024
- 11.0.0CVE-2024-5231718 Nov 2024
- 11.0.6CVE-2025-3165028 Apr 2025
- 11.0.9CVE-2025-5350610 Jul 2025
- 11.0.10CVE-2025-4898913 Aug 2025
- 11.0.15CVE-2025-6661417 Feb 2026Latest listed
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Am I affected? What do I upgrade to?
From GitHub Security Advisories and OSV2 packages in 1 ecosystem. No single main package: each of these ships the affected code.
- Mavenorg.apache.tomcat:tomcat-coyoteAffected: 11.0.0-M2 up to 11.0.6; 10.1.10 up to 10.1.40; 9.0.76 up to 9.0.104; 8.5.0 through 8.5.100Upgrade to 11.0.6 or later (older lines: 10.1.40, 9.0.104)
- Mavenorg.apache.tomcat.embed:tomcat-embed-coreAffected: 11.0.0-M2 up to 11.0.6; 10.1.10 up to 10.1.40; 9.0.76 up to 9.0.104; 8.5.0 through 8.5.100Upgrade to 11.0.11 or later (older lines: 10.1.45, 9.0.109)
What security researchers reported
Not named in any threat report yetAlso mentioned in 1 community threat pulse (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actualización Oracle update - 20/07/202520 Jul 2025