CVE-2025-31650
HIGHApache Tomcat 9.0.76-9.0.102, 10.1.10-10.1.39, 11.0.0-M2-11.0.5 - Denial of Service via HTTP Priority Header Memory Leak
Title source: llmExploitation Summary
EIP tracks 7 public exploits for CVE-2025-31650. PoCs published by Abdualhadi khalifa, absholi7ly, tunahantekeoglu.
AI-analyzed exploit summary This exploit targets a memory leak in Apache Tomcat via invalid HTTP/2 priority headers, causing a Denial of Service (DoS). It sends malformed priority headers to trigger excessive memory consumption.
Description
Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.
Exploits (7)
This exploit targets a memory leak in Apache Tomcat via invalid HTTP/2 priority headers, causing a Denial of Service (DoS). It sends malformed priority headers to trigger excessive memory consumption.
This PoC exploits CVE-2025-31650, a memory leak vulnerability in Apache Tomcat (10.1.10-10.1.39) by sending crafted HTTP/2 requests with invalid priority headers to trigger a DoS condition.
This PoC exploits CVE-2025-31650, a memory exhaustion vulnerability in Apache Tomcat, by sending malformed HTTP/2 priority headers to trigger a DoS condition. The script includes HTTP/2 support verification and async-based request flooding.
This PoC exploits CVE-2025-31650, a memory exhaustion vulnerability in Apache Tomcat, by sending malformed HTTP/2 priority headers to trigger a DoS condition. The script includes HTTP/2 support verification and scalable async-based attack capabilities.
This PoC demonstrates a Denial of Service (DoS) attack against Apache Tomcat 10.1.10 to 10.1.39 by flooding the server with malformed HTTP/2 priority headers. It uses asynchronous requests to overwhelm the target and includes real-time monitoring.
This is a functional DoS exploit for CVE-2025-31650 targeting Apache Tomcat 10.1.10-10.1.39 via malformed HTTP/2 priority headers. It uses async HTTP/2 requests to trigger memory leaks and crash the server.
This repository contains a Python-based scanner for detecting CVE-2025-31650, an HTTP/2 priority vulnerability in Apache Tomcat. It uses Shodan for target discovery and httpx for HTTP/2 vulnerability testing.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H