CVE-2025-31650: Apache Tomcat HTTP priority header memory leak denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote, unauthenticated denial of service with a CVSS of 7.5 and very high EPSS, though no KEV listing or confirmed in-the-wild exploitation is recorded.

What it is

Apache Tomcat mishandles invalid HTTP priority headers, leaving failed requests partially cleaned up and leaking memory. Repeated requests of this kind can exhaust the heap and cause an OutOfMemoryException, taking the server down. The flaw is an improper input validation issue affecting multiple Tomcat release lines.

Impact

An unauthenticated remote attacker can drive memory consumption until the JVM throws OutOfMemoryException, denying service to legitimate users. No data confidentiality or integrity impact is described; the effect is availability loss.

Attack surface

Reachable over the network via HTTP requests carrying malformed priority headers; no authentication or user interaction is required per the CVSS vector (AV:N/PR:N/UI:N). Any endpoint that accepts HTTP requests on an affected Tomcat instance is a potential entry point.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is high at 0.5992 (99.089th percentile), indicating elevated likelihood of attempted exploitation.

What to do

• Upgrade to Tomcat 9.0.104, 10.1.40 or 11.0.6, which fix the issue.
• If immediate upgrade is not possible, retire or isolate the EOL 8.5.x line (8.5.90 through 8.5.100) known to be affected.
• Front Tomcat with a reverse proxy or WAF rule that rejects or normalizes malformed HTTP priority headers.
• Cap JVM heap and enable heap-dump-on-OOM monitoring to limit blast radius and speed diagnosis.
• Track memory growth on exposed Tomcat instances and restart before exhaustion as a stopgap.

Detection

• Monitor JVM heap usage trends for sustained growth correlated with inbound requests containing priority headers.
• Alert on OutOfMemoryException and java.lang.OutOfMemoryError entries in Tomcat or application logs.
• Inspect HTTP access logs for abnormal volumes of requests with malformed or unusual priority header values from single sources.
• Watch for repeated connection patterns or request bursts targeting the same instance without corresponding legitimate traffic.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.