Severity
Medium
Analysis Summary
CVE-2025-31650 CVSS:5.3
Apache Tomcat is vulnerable to a denial of service, caused by incorrect error handling for some invalid HTTP priority headers. By sending an overly large number of requests, a remote attacker could exploit this vulnerability to cause a memory leak.
CVE-2025-31651 CVSS:5.3
Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by the improper neutralization of escape, meta, or control sequences vulnerability. By sending a specially crafted request, an attacker could exploit this vulnerability to bypass some rewrite rules and security constraints.
Impact
- Denial of Service
- Security Bypass
Indicators of Compromise
CVE
CVE-2025-31650
CVE-2025-31651
Affected Vendors
Apache
Affected Products
- Apache Tomcat - 10.1.0-M1
- Apache Tomcat - 11.0.0-M1
- Apache Tomcat - 9.0.0-M1
- Apache Software Foundation Tomcat - 11.0.0-M2
- Apache Tomcat - 9.0.76
Remediation
Upgrade to the latest version of Apache, available from the Apache Security Advisory.