CVE-2025-31650

Estado: ModificadaAlta (7.5)—

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.

This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100.

Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Puntuación base: 7.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 61%
Percentil entre todas las CVEs puntuadas: 99
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access60 %
Impacto principalT1499 Endpoint Denial of Serviceimpact55 %

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network Traffic Vulnerability Scanning Privileged Account Management Network Segmentation Limit Access to Resource Over Network Application Isolation and Sandboxing

Tecnologías afectadas (1)

Apache — Tomcat

CWE

CWE-459
CWE-459

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-31650",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-31650",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-06T20:07:38.530859Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Tomcat",
          "versions": [
            {
              "status": "affected",
              "version": "9.0.76",
              "versionType": "semver",
              "lessThanOrEqual": "9.0.102"
            },
            {
              "status": "affected",
              "version": "10.1.10",
              "versionType": "semver",
              "lessThanOrEqual": "10.1.39"
            },
            {
              "status": "affected",
              "version": "11.0.0-M2",
              "versionType": "semver",
              "lessThanOrEqual": "11.0.5"
            },
            {
              "status": "affected",
              "version": "8.5.90",
              "versionType": "semver",
              "lessThanOrEqual": "8.5.100"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-04-28T20:15:20.653",
  "references": [
    {
      "url": "https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2025/04/28/2",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-459"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-459"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.\n\nThis issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.90 though 8.5.100.\n\n\nUsers are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de validación de entrada incorrecta en Apache Tomcat. La gestión incorrecta de errores en algunos encabezados de prioridad HTTP no válidos provocó una limpieza incompleta de la solicitud fallida, lo que generó una fuga de memoria. Un gran número de solicitudes de este tipo podría generar una excepción OutOfMemoryException, lo que resulta en una denegación de servicio. Este problema afecta a Apache Tomcat: de la 9.0.76 a la 9.0.102, de la 10.1.10 a la 10.1.39 y de la 11.0.0-M2 a la 11.0.5. Se recomienda actualizar a las versiones 9.0.104, 10.1.40 o 11.0.6, que solucionan el problema."
    }
  ],
  "lastModified": "2026-06-17T09:10:43.967",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6F4F87EB-0046-4BAA-91C8-C60C60425186",
              "versionEndExcluding": "9.0.104",
              "versionStartIncluding": "9.0.76"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7EC8AA6F-0BB4-4075-8F2B-DE39FD9A2BD8",
              "versionEndExcluding": "10.1.40",
              "versionStartIncluding": "10.1.10"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "45AB4386-DB38-4808-924A-617CECE9F939",
              "versionEndExcluding": "11.0.6",
              "versionStartIncluding": "11.0.1"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "57088BDD-A136-45EF-A8A1-2EBF79CEC2CE"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B32D1D7A-A04F-444E-8F45-BB9A9E4B0199"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone12:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0092FB35-3B00-484F-A24D-7828396A4FF6"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone13:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CB557E88-FA9D-4B69-AA6F-EAEE7F9B01AC"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone14:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "72D3C6F1-84FA-4F82-96C1-9A8DA1C1F30F"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone15:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3521C81B-37D9-48FC-9540-D0D333B9A4A4"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone16:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "02A84634-A8F2-4BA9-B9F3-BEF36AEC5480"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone17:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ECBBC1F1-C86B-40AF-B740-A99F6B27682A"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone18:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9D2206B2-F3FF-43F2-B3E2-3CAAC64C691D"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone19:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0495A538-4102-40D0-A35C-0179CFD52A9D"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2AAD52CE-94F5-4F98-A027-9A7E68818CB6"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone20:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "77BA6600-0890-4BA1-B447-EC1746BAB4FD"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone21:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7914D26B-CBD6-4846-9BD3-403708D69319"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone22:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "123C6285-03BE-49FC-B821-8BDB25D02863"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone23:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8A28C2E2-B7BC-46CE-94E4-AE3EF172AA47"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone24:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "069B0D8E-8223-4C4E-A834-C6235D6C3450"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone25:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E6282085-5716-4874-B0B0-180ECDEE128F"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1F981F5-035A-4EDD-8A9F-481EE8BC7FF7"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "03A171AF-2EC8-4422-912C-547CDB58CAAA"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "538E68C4-0BA4-495F-AEF8-4EF6EE7963CF"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "49350A6E-5E1D-45B2-A874-3B8601B3ADCC"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5F50942F-DF54-46C0-8371-9A476DD3EEA3"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D12C2C95-B79F-4AA4-8CE3-99A3EE7991AB"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "98792138-DD56-42DF-9612-3BDC65EEC117"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}