CVE-2025-31650

Опубликовано: 28 апр. 2025

Источник: nvd

CVSS3: 7.5

EPSS Низкий

Описание

This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.

Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.

Ссылки

https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826
Mailing List
Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/04/28/2
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

Версия от 9.0.76 (включая) до 9.0.104 (исключая)

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

Версия от 10.1.10 (включая) до 10.1.40 (исключая)

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

Версия от 11.0.1 (включая) до 11.0.6 (исключая)

cpe:2.3:a:apache:tomcat:11.0.0:milestone10:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone11:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone12:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone13:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone14:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone15:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone16:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone17:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone18:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone19:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone20:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone21:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone22:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone23:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone24:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone25:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone3:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone4:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone5:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone6:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone7:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone8:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone9:*:*:*:*:*:*

EPSS

Процентиль: 75%

0.00957

Низкий

7.5 High

CVSS3

Дефекты

CWE-459

Связанные уязвимости

CVE-2025-31650

CVSS3: 7.5

ubuntu

около 2 месяцев назад

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.

CVE-2025-31650

CVSS3: 7.5

redhat

около 2 месяцев назад

CVE-2025-31650

CVSS3: 7.5

debian

около 2 месяцев назад

Improper Input Validation vulnerability in Apache Tomcat. Incorrect er ...

GHSA-3p2h-wqq4-wf4h

github

около 2 месяцев назад

Apache Tomcat Denial of Service via invalid HTTP priority header

BDU:2025-05708

CVSS3: 7.5

fstec

около 2 месяцев назад

Уязвимость сервера приложений Apache Tomcat, связанная с неполной очисткой временных или вспомогательных ресурсов, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 75%

0.00957

Низкий

7.5 High

CVSS3

Дефекты

CWE-459