Description
Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.
This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100.
Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.
Metrics
CVSS 3.1 7.5/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Tomcat | >= 9.0.76, <= 9.0.102; >= 10.1.10, <= 10.1.39; >= 11.0.0-M2, <= 11.0.5; >= 8.5.90, <= 8.5.100 |
References
- https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826Mailing List, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2025/04/28/2Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html
Timeline
- Published
- Apr 28, 2025
- Last modified
- Jun 17, 2026
- NVD status
- Modified