Patchwire CVEs, their patch status, and feeds to follow them

CVE-2025-31650

Fixed in a distro release EPSS 61%CVSS 7.5

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.

Published 2025-04-28 · CVE record · OSV

Products: Apache Software Foundation Apache Tomcat

Fixed upstream

EcosystemPackageFixed in
Mavenorg.apache.tomcat.embed:tomcat-embed-core9.0.104
Mavenorg.apache.tomcat.embed:tomcat-embed-core10.1.40
Mavenorg.apache.tomcat.embed:tomcat-embed-core11.0.6
Mavenorg.apache.tomcat.embed:tomcat-embed-coreno fix
Mavenorg.apache.tomcat:tomcat-coyote9.0.104
Mavenorg.apache.tomcat:tomcat-coyote10.1.40
Mavenorg.apache.tomcat:tomcat-coyote11.0.6
Mavenorg.apache.tomcat:tomcat-coyoteno fix

Distro releases

ReleasePackageFixed in
AlmaLinux 10tomcat91:9.0.87-5.el10_0.1
AlmaLinux 10tomcat9-admin-webapps1:9.0.87-5.el10_0.1
AlmaLinux 10tomcat9-docs-webapp1:9.0.87-5.el10_0.1
AlmaLinux 10tomcat9-el-3.0-api1:9.0.87-5.el10_0.1
AlmaLinux 10tomcat9-jsp-2.3-api1:9.0.87-5.el10_0.1
AlmaLinux 10tomcat9-lib1:9.0.87-5.el10_0.1
AlmaLinux 10tomcat9-servlet-4.0-api1:9.0.87-5.el10_0.1
AlmaLinux 10tomcat9-webapps1:9.0.87-5.el10_0.1
AlmaLinux 8tomcat1:9.0.87-1.el8_10.4
AlmaLinux 8tomcat-admin-webapps1:9.0.87-1.el8_10.4
AlmaLinux 8tomcat-docs-webapp1:9.0.87-1.el8_10.4
AlmaLinux 8tomcat-el-3.0-api1:9.0.87-1.el8_10.4
AlmaLinux 8tomcat-jsp-2.3-api1:9.0.87-1.el8_10.4
AlmaLinux 8tomcat-lib1:9.0.87-1.el8_10.4
AlmaLinux 8tomcat-servlet-4.0-api1:9.0.87-1.el8_10.4
AlmaLinux 8tomcat-webapps1:9.0.87-1.el8_10.4
AlmaLinux 9tomcat1:9.0.87-3.el9_6.1
AlmaLinux 9tomcat-admin-webapps1:9.0.87-3.el9_6.1
AlmaLinux 9tomcat-docs-webapp1:9.0.87-3.el9_6.1
AlmaLinux 9tomcat-el-3.0-api1:9.0.87-3.el9_6.1
AlmaLinux 9tomcat-jsp-2.3-api1:9.0.87-3.el9_6.1
AlmaLinux 9tomcat-lib1:9.0.87-3.el9_6.1
AlmaLinux 9tomcat-servlet-4.0-api1:9.0.87-3.el9_6.1
AlmaLinux 9tomcat-webapps1:9.0.87-3.el9_6.1
Arch Linuxtomcat10no fix
Arch Linuxtomcat9no fix
Chainguardcamunda-zeebe-8.68.6.15-r1
Chainguardcamunda-zeebe-8.6-compat8.6.15-r1
Chainguardthingsboard4.0.1-r1
Chainguardthingsboard-tb-js-executor4.0.1-r1
Chainguardthingsboard-tb-mqtt-transport4.0.1-r1
Chainguardthingsboard-tb-node4.0.1-r1
Chainguardthingsboard-tb-web-ui4.0.1-r1
Chainguardtomcat-8.5.87no fix
Debian 11tomcat99.0.107-0+deb11u1
Debian 12tomcat1010.1.40-1
Debian 12tomcat99.0.70-2
Debian 13tomcat1010.1.40-1
Debian 13tomcat1111.0.6-1
Debian 13tomcat99.0.70-2
Debian 14tomcat1010.1.40-1
Debian 14tomcat1111.0.6-1
Debian 14tomcat99.0.70-2
Red Hat Enterprise Linux 10.0tomcat91:9.0.87-5.el10_0.1
Red Hat Enterprise Linux 10.0tomcat9-admin-webapps1:9.0.87-5.el10_0.1
Red Hat Enterprise Linux 10.0tomcat9-docs-webapp1:9.0.87-5.el10_0.1
Red Hat Enterprise Linux 10.0tomcat9-el-3.0-api1:9.0.87-5.el10_0.1
Red Hat Enterprise Linux 10.0tomcat9-jsp-2.3-api1:9.0.87-5.el10_0.1
Red Hat Enterprise Linux 10.0tomcat9-lib1:9.0.87-5.el10_0.1
Red Hat Enterprise Linux 10.0tomcat9-servlet-4.0-api1:9.0.87-5.el10_0.1
Red Hat Enterprise Linux 10.0tomcat9-webapps1:9.0.87-5.el10_0.1
Red Hat Enterprise Linux 10.2tomcat1:10.1.49-1.el10
Red Hat Enterprise Linux 10.2tomcat-admin-webapps1:10.1.49-1.el10
Red Hat Enterprise Linux 10.2tomcat-docs-webapp1:10.1.49-1.el10
Red Hat Enterprise Linux 10.2tomcat-el-5.0-api1:10.1.49-1.el10
Red Hat Enterprise Linux 10.2tomcat-jsp-3.1-api1:10.1.49-1.el10
Red Hat Enterprise Linux 10.2tomcat-lib1:10.1.49-1.el10
Red Hat Enterprise Linux 10.2tomcat-servlet-6.0-api1:10.1.49-1.el10
Red Hat Enterprise Linux 10.2tomcat-webapps1:10.1.49-1.el10
Red Hat Enterprise Linux 8tomcat1:9.0.87-1.el8_10.4
Red Hat Enterprise Linux 8tomcat-admin-webapps1:9.0.87-1.el8_10.4
Red Hat Enterprise Linux 8tomcat-docs-webapp1:9.0.87-1.el8_10.4
Red Hat Enterprise Linux 8tomcat-el-3.0-api1:9.0.87-1.el8_10.4
Red Hat Enterprise Linux 8tomcat-jsp-2.3-api1:9.0.87-1.el8_10.4
Red Hat Enterprise Linux 8tomcat-lib1:9.0.87-1.el8_10.4
Red Hat Enterprise Linux 8tomcat-servlet-4.0-api1:9.0.87-1.el8_10.4
Red Hat Enterprise Linux 8tomcat-webapps1:9.0.87-1.el8_10.4
Red Hat Enterprise Linux 9tomcat1:9.0.87-3.el9_6.1
Red Hat Enterprise Linux 9tomcat-admin-webapps1:9.0.87-3.el9_6.1
Red Hat Enterprise Linux 9tomcat-docs-webapp1:9.0.87-3.el9_6.1
Red Hat Enterprise Linux 9tomcat-el-3.0-api1:9.0.87-3.el9_6.1
Red Hat Enterprise Linux 9tomcat-jsp-2.3-api1:9.0.87-3.el9_6.1
Red Hat Enterprise Linux 9tomcat-lib1:9.0.87-3.el9_6.1
Red Hat Enterprise Linux 9tomcat-servlet-4.0-api1:9.0.87-3.el9_6.1
Red Hat Enterprise Linux 9tomcat-webapps1:9.0.87-3.el9_6.1
Red Hat jboss enterprise web server 5.8jws5-tomcat0:9.0.87-11.redhat_00010.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat0:9.0.87-11.redhat_00010.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat0:9.0.87-11.redhat_00010.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-admin-webapps0:9.0.87-11.redhat_00010.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-admin-webapps0:9.0.87-11.redhat_00010.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-admin-webapps0:9.0.87-11.redhat_00010.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-docs-webapp0:9.0.87-11.redhat_00010.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-docs-webapp0:9.0.87-11.redhat_00010.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-docs-webapp0:9.0.87-11.redhat_00010.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-el-3.0-api0:9.0.87-11.redhat_00010.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-el-3.0-api0:9.0.87-11.redhat_00010.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-el-3.0-api0:9.0.87-11.redhat_00010.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-java-jdk110:9.0.87-11.redhat_00010.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-java-jdk80:9.0.87-11.redhat_00010.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-javadoc0:9.0.87-11.redhat_00010.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-javadoc0:9.0.87-11.redhat_00010.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-javadoc0:9.0.87-11.redhat_00010.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-jsp-2.3-api0:9.0.87-11.redhat_00010.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-jsp-2.3-api0:9.0.87-11.redhat_00010.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-jsp-2.3-api0:9.0.87-11.redhat_00010.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-lib0:9.0.87-11.redhat_00010.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-lib0:9.0.87-11.redhat_00010.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-lib0:9.0.87-11.redhat_00010.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-selinux0:9.0.87-11.redhat_00010.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-selinux0:9.0.87-11.redhat_00010.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-selinux0:9.0.87-11.redhat_00010.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-servlet-4.0-api0:9.0.87-11.redhat_00010.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-servlet-4.0-api0:9.0.87-11.redhat_00010.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-servlet-4.0-api0:9.0.87-11.redhat_00010.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-webapps0:9.0.87-11.redhat_00010.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-webapps0:9.0.87-11.redhat_00010.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-webapps0:9.0.87-11.redhat_00010.1.el7jws
Red Hat jboss enterprise web server 6.1jws6-tomcat0:10.1.36-6.redhat_00007.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat0:10.1.36-6.redhat_00007.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-admin-webapps0:10.1.36-6.redhat_00007.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-admin-webapps0:10.1.36-6.redhat_00007.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-docs-webapp0:10.1.36-6.redhat_00007.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-docs-webapp0:10.1.36-6.redhat_00007.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-el-5.0-api0:10.1.36-6.redhat_00007.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-el-5.0-api0:10.1.36-6.redhat_00007.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-jakartaee-migration0:1.0.6-2.redhat_00003.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-jakartaee-migration0:1.0.6-2.redhat_00003.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-javadoc0:10.1.36-6.redhat_00007.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-javadoc0:10.1.36-6.redhat_00007.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-jsp-3.1-api0:10.1.36-6.redhat_00007.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-jsp-3.1-api0:10.1.36-6.redhat_00007.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-lib0:10.1.36-6.redhat_00007.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-lib0:10.1.36-6.redhat_00007.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-native0:1.3.1-1.redhat_1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-native0:1.3.1-1.redhat_1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-native-debuginfo0:1.3.1-1.redhat_1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-native-debuginfo0:1.3.1-1.redhat_1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-selinux0:10.1.36-6.redhat_00007.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-selinux0:10.1.36-6.redhat_00007.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-servlet-6.0-api0:10.1.36-6.redhat_00007.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-servlet-6.0-api0:10.1.36-6.redhat_00007.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-webapps0:10.1.36-6.redhat_00007.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-webapps0:10.1.36-6.redhat_00007.1.el8jws
Red Hat rhel e4s 8.8tomcat1:9.0.87-1.el8_8.5
Red Hat rhel e4s 8.8tomcat-admin-webapps1:9.0.87-1.el8_8.5
Red Hat rhel e4s 8.8tomcat-docs-webapp1:9.0.87-1.el8_8.5
Red Hat rhel e4s 8.8tomcat-el-3.0-api1:9.0.87-1.el8_8.5
Red Hat rhel e4s 8.8tomcat-jsp-2.3-api1:9.0.87-1.el8_8.5
Red Hat rhel e4s 8.8tomcat-lib1:9.0.87-1.el8_8.5
Red Hat rhel e4s 8.8tomcat-servlet-4.0-api1:9.0.87-1.el8_8.5
Red Hat rhel e4s 8.8tomcat-webapps1:9.0.87-1.el8_8.5
Red Hat rhel e4s 9.2tomcat1:9.0.87-1.el9_2.4
Red Hat rhel e4s 9.2tomcat-admin-webapps1:9.0.87-1.el9_2.4
Red Hat rhel e4s 9.2tomcat-docs-webapp1:9.0.87-1.el9_2.4
Red Hat rhel e4s 9.2tomcat-el-3.0-api1:9.0.87-1.el9_2.4
Red Hat rhel e4s 9.2tomcat-jsp-2.3-api1:9.0.87-1.el9_2.4
Red Hat rhel e4s 9.2tomcat-lib1:9.0.87-1.el9_2.4
Red Hat rhel e4s 9.2tomcat-servlet-4.0-api1:9.0.87-1.el9_2.4
Red Hat rhel e4s 9.2tomcat-webapps1:9.0.87-1.el9_2.4
Red Hat rhel eus 9.4tomcat1:9.0.87-1.el9_4.4
Red Hat rhel eus 9.4tomcat-admin-webapps1:9.0.87-1.el9_4.4
Red Hat rhel eus 9.4tomcat-docs-webapp1:9.0.87-1.el9_4.4
Red Hat rhel eus 9.4tomcat-el-3.0-api1:9.0.87-1.el9_4.4
Red Hat rhel eus 9.4tomcat-jsp-2.3-api1:9.0.87-1.el9_4.4
Red Hat rhel eus 9.4tomcat-lib1:9.0.87-1.el9_4.4
Red Hat rhel eus 9.4tomcat-servlet-4.0-api1:9.0.87-1.el9_4.4
Red Hat rhel eus 9.4tomcat-webapps1:9.0.87-1.el9_4.4
Red Hat rhel tus 8.8tomcat1:9.0.87-1.el8_8.5
Red Hat rhel tus 8.8tomcat-admin-webapps1:9.0.87-1.el8_8.5
Red Hat rhel tus 8.8tomcat-docs-webapp1:9.0.87-1.el8_8.5
Red Hat rhel tus 8.8tomcat-el-3.0-api1:9.0.87-1.el8_8.5
Red Hat rhel tus 8.8tomcat-jsp-2.3-api1:9.0.87-1.el8_8.5
Red Hat rhel tus 8.8tomcat-lib1:9.0.87-1.el8_8.5
Red Hat rhel tus 8.8tomcat-servlet-4.0-api1:9.0.87-1.el8_8.5
Red Hat rhel tus 8.8tomcat-webapps1:9.0.87-1.el8_8.5
Rocky Linux 10tomcat91:9.0.87-5.el10_0.1
Rocky Linux 8tomcat1:9.0.87-1.el8_10.4
Rocky Linux 9tomcat1:9.0.87-3.el9_6.1
SUSE Enterprise Storage 7.1tomcat9.0.104-150200.81.1
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSStomcat9.0.104-150200.81.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOStomcat9.0.104-150200.81.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSStomcat9.0.104-150200.81.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOStomcat9.0.104-150200.81.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOStomcat1010.1.40-150200.5.40.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSStomcat9.0.104-150200.81.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSStomcat1010.1.40-150200.5.40.1
SUSE Linux Enterprise Module for Web and Scripting 15 SP6tomcat9.0.104-150200.81.1
SUSE Linux Enterprise Module for Web and Scripting 15 SP6tomcat1010.1.40-150200.5.40.1
SUSE Linux Enterprise Module for Web and Scripting 15 SP7tomcat9.0.104-150200.81.1
SUSE Linux Enterprise Module for Web and Scripting 15 SP7tomcat1010.1.40-150200.5.40.1
SUSE Linux Enterprise Server 15 SP3-LTSStomcat9.0.104-150200.81.1
SUSE Linux Enterprise Server 15 SP4-LTSStomcat9.0.104-150200.81.1
SUSE Linux Enterprise Server 15 SP5-LTSStomcat9.0.104-150200.81.1
SUSE Linux Enterprise Server 15 SP5-LTSStomcat1010.1.40-150200.5.40.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3tomcat9.0.104-150200.81.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4tomcat9.0.104-150200.81.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5tomcat9.0.104-150200.81.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5tomcat1010.1.40-150200.5.40.1
SUSE Manager Server 4.3tomcat9.0.104-150200.81.1
Ubuntu Pro 24.04 LTStomcat1010.1.16-1ubuntu0.1~esm3
Wolfithingsboard4.0.1-r1
Wolfithingsboard-tb-js-executor4.0.1-r1
Wolfithingsboard-tb-mqtt-transport4.0.1-r1
Wolfithingsboard-tb-node4.0.1-r1
Wolfithingsboard-tb-web-ui4.0.1-r1
openSUSE Leap 15.6tomcat9.0.104-150200.81.1
openSUSE Leap 15.6tomcat1010.1.40-150200.5.40.1
openSUSE Tumbleweedtomcat9.0.104-1.1
openSUSE Tumbleweedtomcat1010.1.40-1.1