CVE-2025-31650

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.

• CWE-459
• CWE-459

• https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826Mailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2025/04/28/2Mailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html

Published

Apr 28, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-31644When running in Appliance mode, a command injection vulnerab…8.7
• CVE-2025-31645Uncontrolled search path for some System Event Log Viewer Ut…6.7
• CVE-2025-31647Uncontrolled search path for some Intel(R) Graphics Software…6.7
• CVE-2025-31648Improper handling of values in the microcode flow for some I…3.9
• CVE-2025-31649A hard-coded password vulnerability exists in the ControlVau…8.7
• CVE-2025-3165A vulnerability classified as critical has been found in thu…5.3
• CVE-2025-31651Improper Neutralization of Escape, Meta, or Control Sequence…9.8
• CVE-2025-31654An attacker can get information about the groups of the smar…6.9
• CVE-2025-31655Incorrect default permissions for some Intel(R) Battery Life…6.7
• CVE-2025-3166A vulnerability classified as critical was found in code-pro…7.8
• CVE-2025-3167A vulnerability, which was classified as problematic, has be…7.5
• CVE-2025-31672Improper Input Validation vulnerability in Apache POI. The i…5.3