{"action":"Upgrade org.apache.tomcat.embed:tomcat-embed-core to 9.0.104 (9.x), 10.1.40 (10.x) or 11.0.6 (11.x) or later.","affected":[{"fixed":"9.0.104","introduced":"9.0.76"},{"fixed":"10.1.40","introduced":"10.1.10"},{"fixed":"11.0.6","introduced":"11.0.0-M2"},{"introduced":"8.5.0","last_affected":"8.5.100"}],"component":"org.apache.tomcat.embed:tomcat-embed-core","cve_ids":["CVE-2025-31650"],"ecosystem":"Maven","epss":0.61322,"exploited":false,"fixed_versions":["9.0.104","10.1.40","11.0.6"],"ghsa_id":"GHSA-3p2h-wqq4-wf4h","id":"tcs_01M5N893VBGTJ820PFSZQ1TJQG","modified_at":"2026-09-10T03:50:57.424635503Z","published_at":"2025-04-28T21:30:43Z","references":["https://osv.dev/vulnerability/GHSA-3p2h-wqq4-wf4h","https://nvd.nist.gov/vuln/detail/CVE-2025-31650","https://github.com/apache/tomcat/commit/1eef1dc459c45f1e421d8bd25ef340fc1cc34edc","https://github.com/apache/tomcat/commit/40ae788c2e64d018b4e58cd4210bb96434d0100d","https://github.com/apache/tomcat/commit/75554da2fc5574862510ae6f0d7b3d78937f1d40","https://github.com/apache/tomcat/commit/8cc3b8fb3f2d8d4d6a757e014f19d1fafa948a60","https://github.com/apache/tomcat/commit/b7674782679e1514a0d154166b1d04d38aaac4a9","https://github.com/apache/tomcat/commit/b98e74f517b36929f4208506e5adad22cb767baa","https://github.com/apache/tomcat/commit/cba1a0fe1289ee7f5dd46c61c38d1e1ac5437bff","https://github.com/apache/tomcat/commit/ded0285b96b4d3f5560dfc8856ad5ec4a9b50ba9","https://github.com/apache/tomcat/commit/f619e6a05029538886d5a9d987925d573b5bb8c2","https://github.com/apache/tomcat","https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html","https://tomcat.apache.org/security-10.html","https://tomcat.apache.org/security-11.html","https://tomcat.apache.org/security-9.html","http://www.openwall.com/lists/oss-security/2025/04/28/2"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-3p2h-wqq4-wf4h#Maven/org.apache.tomcat.embed:tomcat-embed-core","url":"https://osv.dev/vulnerability/GHSA-3p2h-wqq4-wf4h"},{"source":"nvd","source_id":"CVE-2025-31650","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31650"}],"summary":"Apache Tomcat Denial of Service via invalid HTTP priority header"}