Apache Tomcat Vulnerability Enables Rule Bypass and Denial-of-Service Attacks
The Apache Software Foundation has disclosed a high-severity vulnerability in Apache Tomcat, identified as CVE-2025-31650, which could allow attackers to bypass security rules and cause denial-of-service (DoS) conditions by exploiting malformed HTTP Priority headers.
The issue affects multiple versions of Tomcat and arises from improper input validation during the handling of HTTP Priority headers. According to the official advisory, invalid headers are not handled correctly, resulting in incomplete request cleanup and ultimately causing a memory leak. Repeated exploitation by sending numerous malformed requests can trigger an OutOfMemoryException, rendering the server unavailable.
While the HTTP Priority header is a standard feature for managing response prioritization in client-server communications, this flaw demonstrates a critical gap in Tomcat’s input validation logic, leaving systems exposed to DoS attacks.
Risk Assessment Summary
| Risk Factor | Details |
|---|---|
| Affected Products | – Apache Tomcat 9.0.76 to 9.0.102- Apache Tomcat 10.1.10 to 10.1.39- Apache Tomcat 11.0.0-M2 to 11.0.5 |
| Impact | Denial of Service (DoS) |
| Exploit Requirements | No authentication required; attacker must send a high volume of HTTP requests with malformed HTTP Priority headers |
| CVSS v3.1 Score | High |
Affected Apache Tomcat Versions and Mitigation Guidance
The newly disclosed vulnerability affects the following versions of Apache Tomcat:
- Tomcat 11.0.0-M2 to 11.0.5
- Tomcat 10.1.10 to 10.1.39
- Tomcat 9.0.76 to 9.0.102
Users running any of these versions should promptly upgrade to a patched release to prevent potential exploitation.
Vulnerability Overview
This flaw is tied to the way Tomcat manages memory when handling HTTP Priority headers. Specifically, when the server receives malformed HTTP Priority headers, it fails to clean up resources correctly, leading to a memory leak. Repeatedly sending such requests can eventually result in an OutOfMemoryException, effectively causing a Denial of Service (DoS) by crashing the application.
As noted in the advisory, “a large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.”
This issue echoes previous Java memory management problems. As one system administrator previously observed, “Tomcat is unable to release unused memory. It just adds the memory and reaches its maximum allocated memory.”
Mitigation Recommendations
The Apache Software Foundation advises users to upgrade to the following secure versions:
- Tomcat 11.0.6 or later
- Tomcat 10.1.40 or later
- Tomcat 9.0.104 or later
While version 9.0.103 included a fix for this issue, it was not officially released due to a failed release vote and is therefore not recommended for deployment.
Recent Context
This marks the second major Apache Tomcat vulnerability in 2025. In March, CVE-2025-24813, a critical remote code execution flaw with a CVSS score of 9.8, was disclosed, allowing attackers to gain control over affected servers.
Given the risk of service disruption and potential downtime, immediate patching is strongly advised.
