This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Apache Tomcat fixes 2 vulnerabilities
Apache Software Foundation fixes 2 vulnerabilities in Apache Tomcat with versions 11.0.6, 10.1.40 and 9.0.104 [1][2].
Allows an unauthenticated remote attacker, due to improper error handling when processing invalid HTTP priority headers, to cause a memory leak, which with a larger number of malformed requests can lead to memory exhaustion and a DoS attack [1].
The vulnerability is present in product:
- Apache Tomcat; >=11.0.0-M2, <=11.0.5; >=10.1.10, <=10.1.39; >=9.0.76, <=9.0.102
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-31650 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
The vulnerability was publicly disclosed 28. 4. 2025.
Allows an unauthenticated remote attacker, due to a flaw in rewrite rules, to bypass security restrictions in certain configurations [2].
The vulnerability is present in product:
- Apache Tomcat; >=11.0.0-M2, <=11.0.5; >=10.1.10, <=10.1.39; >=9.0.76, <=9.0.102
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-31651 at cve.org, NVD
- CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences at cwe.mitre.org
The vulnerability was publicly disclosed 28. 4. 2025.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 29. 4. 2025.