Memory Leak Vulnerability in Apache Tomcat: CVE-2025-31650
Summary
CVE-2025-31650: Improper Input Validation vulnerability in Apache Tomcat. Affects tomcat10 versions >= ff0629ca2bd82d6bff5245c02b42d932149df34d, < f8cfae0a0d1c8dc592099a1430cd08e352430823. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java applications. The software is known for its robustness, scalability, and support for various Java specifications. However, it is susceptible to vulnerabilities that can affect its performance and security, such as the improper input validation issue identified in CVE-2025-31650.
Vulnerability Detail
CVE-2025-31650 is an improper input validation vulnerability in Apache Tomcat that arises from incorrect error handling for invalid HTTP priority headers. This flaw leads to incomplete clean-up of failed requests, resulting in a memory leak. If a large number of such requests are made, it can trigger an OutOfMemoryException, causing a denial of service. The vulnerability affects multiple versions of Tomcat, including 9.0.76 through 9.0.102, 10.1.10 through 10.1.39, and 11.0.0-M2 through 11.0.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can limit the number of invalid HTTP requests processed by the server or implement rate limiting to mitigate the impact of potential denial of service attacks until the upgrade is completed.
Conclusion
CVE-2025-31650 is a significant vulnerability in Apache Tomcat that can lead to memory leaks and denial of service. Users are strongly advised to upgrade to the latest patched versions to ensure their systems remain secure. Temporary workarounds can help mitigate risks until an upgrade is feasible.
See every vulnerability recorded for tomcat10 →
FAQ
CVE-2025-31650 is a vulnerability in Apache Tomcat that causes memory leaks due to improper input validation of HTTP priority headers.
The vulnerability affects Apache Tomcat versions from 9.0.76 to 9.0.102, 10.1.10 to 10.1.39, and 11.0.0-M2 to 11.0.5.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application using the Vulert playground at Vulert Scanner.
The main consequence is a denial of service due to OutOfMemoryExceptions triggered by memory leaks from invalid HTTP requests.
If an immediate upgrade is not possible, consider implementing rate limiting or restricting the number of invalid requests to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat10.
