Maven/org.apache.tomcat.embed:tomcat-embed-core CVE-2025-31650: high 7.5, EPSS 61.32%
Apache Tomcat Denial of Service via invalid HTTP priority header
Action: Upgrade org.apache.tomcat.embed:tomcat-embed-core to 9.0.104 (9.x), 10.1.40 (10.x) or 11.0.6 (11.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 9.0.76 | 9.0.104 | - |
| 10.1.10 | 10.1.40 | - |
| 11.0.0-M2 | 11.0.6 | - |
| 8.5.0 | - | 8.5.100 |
Fixed versions
| 9.0.104 | 10.1.40 | 11.0.6 |
Sources
- osv: GHSA-3p2h-wqq4-wf4h#Maven/org.apache.tomcat.embed:tomcat-embed-core
- nvd: CVE-2025-31650
- https://github.com/apache/tomcat/commit/1eef1dc459c45f1e421d8bd25ef340fc1cc34edc
- https://github.com/apache/tomcat/commit/40ae788c2e64d018b4e58cd4210bb96434d0100d
- https://github.com/apache/tomcat/commit/75554da2fc5574862510ae6f0d7b3d78937f1d40
- https://github.com/apache/tomcat/commit/8cc3b8fb3f2d8d4d6a757e014f19d1fafa948a60
- https://github.com/apache/tomcat/commit/b7674782679e1514a0d154166b1d04d38aaac4a9
- https://github.com/apache/tomcat/commit/b98e74f517b36929f4208506e5adad22cb767baa
- https://github.com/apache/tomcat/commit/cba1a0fe1289ee7f5dd46c61c38d1e1ac5437bff
- https://github.com/apache/tomcat/commit/ded0285b96b4d3f5560dfc8856ad5ec4a9b50ba9
- https://github.com/apache/tomcat/commit/f619e6a05029538886d5a9d987925d573b5bb8c2
- https://github.com/apache/tomcat
- https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826
- https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html
- https://tomcat.apache.org/security-10.html
- https://tomcat.apache.org/security-11.html
- https://tomcat.apache.org/security-9.html
- http://www.openwall.com/lists/oss-security/2025/04/28/2
CVE-2025-31650 · published · modified · JSON