CVE-2025-31650

A flaw was found in Apache Tomcat. This vulnerability allows an application-level denial of service (DoS), causing it to become unresponsive or slow via maliciously crafted HTTP/2 prioritization headers. It performs an incomplete cleanup of failed requests, which triggers a memory leak.

This is marked as Important vulnerability rather than a Moderate flaw because it introduces a reliable, unauthenticated denial-of-service (DoS) vector that exploits the core request-handling mechanism in Apache Tomcat. Specifically, the improper handling of invalid HTTP/2 Priority headers results in incomplete memory deallocation, creating a server-side memory leak. Unlike transient request errors that are gracefully handled and discarded, these malformed requests accumulate residual memory allocations over time.

This means an attacker can trigger an OutOfMemoryException simply by sending a large volume of crafted HTTP/2 requests, effectively rendering the server non-functional without needing authentication or access to specific endpoints. Given that HTTP/2 is widely used in production environments to improve performance, this vulnerability targets a default, high-traffic pathway, making it more impactful.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.