ExploitPublished 5 Jun 2025

Apache Tomcat 10.1.39 · Denial of Service (DoS)

Source Exploit-DB RSS Feed

Mentioned vulnerabilities

CVE-2025-31650

Severity

Medium

Rated by Threat Radar

Data as of 11 Jun 2025, 23:44 UTC

What to do

AI-suggested

Immediate upgrade: Organizations should upgrade Apache Tomcat to a version later than 10.1.39 once an official patch is released. In the absence of a patch, consider downgrading to a non-vulnerable version or disabling HTTP/2 support if feasible.
HTTP/2 filtering: Deploy network-level controls such as Web Application Firewalls (WAFs) or reverse proxies that can inspect and filter malformed HTTP/2 priority headers to block suspicious traffic before it reaches the Tomcat server.
Rate limiting: Implement strict rate limiting on incoming HTTP/2 connections and requests to reduce the impact of flooding attacks.
Monitoring and alerting: Enhance monitoring of Tomcat server memory usage, response times, and availability. Use tools like VisualVM or analyze catalina.out logs for OutOfMemoryError or other memory-related exceptions.
Network segmentation: Isolate critical Tomcat servers behind internal firewalls and restrict access to trusted networks to reduce exposure.
Incident response preparation: Develop and test incident response plans specifically for DoS scenarios affecting Tomcat services.
Disable HTTP/2 if not required: If HTTP/2 is not essential for the application, disable it to eliminate the attack vector.
Vendor communication: Stay in contact with Apache Tomcat maintainers for timely patch releases and advisories.

Description

Apache Tomcat 10.1.39 - Denial of Service (DoS)

Impact

For European organizations, this vulnerability poses a significant risk to any infrastructure relying on Apache Tomcat 10.1.x servers with HTTP/2 enabled. Tomcat is widely used in enterprise web applications, middleware, and cloud services. A successful DoS attack could disrupt critical business applications, leading to service outages, loss of productivity, and potential financial losses. Organizations in sectors such as finance, government, healthcare, and telecommunications, which often use Tomcat for internal and external-facing services, could experience degraded service availability or complete downtime. The attack's remote nature and lack of authentication requirements mean that threat actors can exploit this vulnerability from anywhere, increasing the risk of widespread disruption. Additionally, the memory leak nature of the vulnerability may complicate detection and mitigation, as the server may degrade gradually before crashing, potentially evading some monitoring systems. This could also increase the time to recovery and incident response. The absence of known exploits in the wild currently provides a window for proactive mitigation, but the availability of public exploit code raises the risk of imminent exploitation attempts.

Indicators of compromise

Exploit source code

Exploit code for Apache Tomcat 10.1.39 - Denial of Service (DoS)6,628 characters

# Exploit Title: Apache Tomcat 10.1.39 - Denial of Service (DOS)
# Author: Abdualhadi khalifa
# CVE: CVE-2025-31650

import httpx
import asyncio
import random
import urllib.parse
import sys
import socket
from colorama import init, Fore, Style

init()

class TomcatKiller:
    def __init__(self):
        self.success_count = 0
        self.error_count = 0
        self.invalid_priorities = [
            \\\"u=-1, q=2\\\",
            \\\"u=4294967295, q=-1\\\",
            \\\"u=-2147483648, q=1.5\…

References

Community reviews

Loading reviews…