SB2025042851 - Multiple vulnerabilities in Apache Tomcat

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Improper error handling (CVE-ID: CVE-2025-31650)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient error handling for certain invalid HTTP priority headers. A remote attacker can send a large amount of specially crafted HTTP requests to the server and consume all available memory, resulting in a denial of service condition.

2) Input validation error (CVE-ID: CVE-2025-31651)

The vulnerability allows a remote attacker to bypass rewrite rules.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted input to the application and bypass configured rewrite rules.

Remediation

Install update from vendor's website.

References

• https://lists.apache.org/thread/q4ld9xtv3zrvvs3ykp4b2f9j2tvhq6bl
• https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.6
• https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.40
• https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.104
• https://lists.apache.org/thread/x7l5ldwkson33bf4b3s3738lwjql618z