Search: CVE-2025-31650

Apache Tomcat contains an improper input validation vulnerability in handling malformed HTTP/2 PRIORITY_UPDATE frames. This flaw causes incorrect error handling for some invalid HTTP priority headers, leading to incomplete cleanup of failed requests and a memory leak. A large number of such requests can trigger an OutOfMemoryException, resulting in a denial of service. The issue affects multiple versions across Tomcat 8.5, 9.0, 10.1, and 11.0 branches. Fixed versions have been released to address this vulnerability.