CVE-2025-31650

CVE-2025-31650 is an improper input validation flaw (CWE-459) in Apache Tomcat where certain invalid HTTP priority headers are mishandled, leaving the failed request incompletely cleaned up and leaking memory. An unauthenticated remote attacker can trigger it by sending a large number of requests with such malformed priority headers, and the accumulated leak eventually causes an OutOfMemoryException. The impact is denial of service — the affected Tomcat instance can crash or become unavailable, with no direct confidentiality or confidentiality-side impact beyond availability. Any deployment running the affected versions is exposed, especially internet-facing Tomcat servers and legacy users still on EOL 8.5.x releases. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but EPSS assigns a roughly 60% probability of exploitation within 30 days (99th percentile).

What to do: Upgrade to Tomcat 9.0.104, 10.1.40, or 11.0.6, which fix the issue; sites on EOL 8.5.x (8.5.90–8.5.100) should move to a fixed supported version such as 9.0.104. As an interim mitigation, strip or validate HTTP priority headers at a reverse proxy or CDN layer and monitor JVM heap for abnormal growth or restarts. Prioritize internet-facing Tomcat instances given the high EPSS exploitation probability.