Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2025-05708

Опубликовано: 28 апр. 2025
Источник: fstec
CVSS3: 7.5
CVSS2: 7.8
EPSS Низкий

Описание

Уязвимость сервера приложений Apache Tomcat связана с неполной очисткой временных или вспомогательных ресурсов. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании путем отправки большого количества специально созданных HTTP-запросов

Вендор

Novell Inc.
Red Hat Inc.
ООО «Ред Софт»
Apache Software Foundation

Наименование ПО

OpenSUSE Leap
Red Hat Enterprise Linux
РЕД ОС
Suse Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
Red Hat JBoss Web Server
Apache Tomcat

Версия ПО

15.5 (OpenSUSE Leap)
8 (Red Hat Enterprise Linux)
15.3 (OpenSUSE Leap)
7.3 (РЕД ОС)
15.4 (OpenSUSE Leap)
15 SP3 (Suse Linux Enterprise Server)
15 SP3 (SUSE Linux Enterprise Server for SAP Applications)
15 SP2 (Suse Linux Enterprise Server)
15 SP2 (SUSE Linux Enterprise Server for SAP Applications)
15 SP4 (Suse Linux Enterprise Server)
15 SP2-BCL (Suse Linux Enterprise Server)
15 SP4 (SUSE Linux Enterprise Server for SAP Applications)
9 (Red Hat Enterprise Linux)
15 SP2-LTSS (Suse Linux Enterprise Server)
15 SP3-LTSS (Suse Linux Enterprise Server)
15 SP3-BCL (Suse Linux Enterprise Server)
15 SP5 (SUSE Linux Enterprise Server for SAP Applications)
15 SP5 (Suse Linux Enterprise Server)
5 (Red Hat JBoss Web Server)
15 SP4-LTSS (Suse Linux Enterprise Server)
6 (Red Hat JBoss Web Server)
15 SP6 (Suse Linux Enterprise Server)
15 SP6 (SUSE Linux Enterprise Server for SAP Applications)
15.6 (OpenSUSE Leap)
5.8 on RHEL 7 (Red Hat JBoss Web Server)
5.8 on RHEL 8 (Red Hat JBoss Web Server)
5.8 on RHEL 9 (Red Hat JBoss Web Server)
15 SP5-LTSS (Suse Linux Enterprise Server)
15 SP7 (Suse Linux Enterprise Server)
15 SP7 (SUSE Linux Enterprise Server for SAP Applications)
от 11.0.0-M2 до 11.0.5 включительно (Apache Tomcat)
от 10.1.10 до 10.1.39 включительно (Apache Tomcat)
от 9.0.76 до 9.0.102 включительно (Apache Tomcat)
6.1 on RHEL 8 (Red Hat JBoss Web Server)
6.1 on RHEL 9 (Red Hat JBoss Web Server)

Тип ПО

Операционная система
Сетевое средство
Сетевое программное средство

Операционные системы и аппаратные платформы

Novell Inc. OpenSUSE Leap 15.5
Red Hat Inc. Red Hat Enterprise Linux 8
Novell Inc. OpenSUSE Leap 15.3
ООО «Ред Софт» РЕД ОС 7.3
Novell Inc. OpenSUSE Leap 15.4
Novell Inc. Suse Linux Enterprise Server 15 SP3
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP3
Novell Inc. Suse Linux Enterprise Server 15 SP2
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP2
Novell Inc. Suse Linux Enterprise Server 15 SP4
Novell Inc. Suse Linux Enterprise Server 15 SP2-BCL
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP4
Red Hat Inc. Red Hat Enterprise Linux 9
Novell Inc. Suse Linux Enterprise Server 15 SP2-LTSS
Novell Inc. Suse Linux Enterprise Server 15 SP3-LTSS
Novell Inc. Suse Linux Enterprise Server 15 SP3-BCL
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP5
Novell Inc. Suse Linux Enterprise Server 15 SP5
Novell Inc. Suse Linux Enterprise Server 15 SP4-LTSS
Novell Inc. Suse Linux Enterprise Server 15 SP6
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP6
Novell Inc. OpenSUSE Leap 15.6
Novell Inc. Suse Linux Enterprise Server 15 SP5-LTSS
Novell Inc. Suse Linux Enterprise Server 15 SP7
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP7

Уровень опасности уязвимости

Высокий уровень опасности (базовая оценка CVSS 2.0 составляет 7,8)
Высокий уровень опасности (базовая оценка CVSS 3.0 составляет 7,5)

Возможные меры по устранению уязвимости

Использование рекомендаций:
Для Apache Tomcat:
https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826
Для программных продуктов Red Hat Inc.:
https://access.redhat.com/security/cve/CVE-2025-31650
Для программных продуктов Novell Inc.:
https://www.suse.com/security/cve/CVE-2025-31650.html
Для РедОС:
http://repo.red-soft.ru/redos/7.3c/x86_64/updates/

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Существует в открытом доступе

Информация об устранении

Уязвимость устранена

EPSS

Процентиль: 75%
0.00957
Низкий

7.5 High

CVSS3

7.8 High

CVSS2

Связанные уязвимости

CVSS3: 7.5
ubuntu
около 2 месяцев назад

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.

CVSS3: 7.5
redhat
около 2 месяцев назад

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.

CVSS3: 7.5
nvd
около 2 месяцев назад

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.

CVSS3: 7.5
debian
около 2 месяцев назад

Improper Input Validation vulnerability in Apache Tomcat. Incorrect er ...

github
около 2 месяцев назад

Apache Tomcat Denial of Service via invalid HTTP priority header

EPSS

Процентиль: 75%
0.00957
Низкий

7.5 High

CVSS3

7.8 High

CVSS2