CVE-2025-31650

Katalog CVE

CVSS 7.5 · High EPSS 61,3%

Kerentanan Incomplete Cleanup pada apache tomcat. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.

Rincian

Terbit di NVD

28 April 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-459: Incomplete Cleanup

EPSS (30 hari)

61,3% peluang dieksploitasi; lebih tinggi dari 99,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826 mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2025/04/28/2 mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html