Apache Tomcat contains an improper input validation vulnerability in its HTTP priority header handling that causes incomplete cleanup of failed requests, leading to a memory leak. This can result in an OutOfMemoryException and denial of service when processing many such requests. The flaw affects multiple versions across Tomcat 8.5, 9.0, 10.1, and 11.0 branches. Fixed versions are 9.0.104, 10.1.40, and 11.0.6.