NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
☕ Maven
Not in CISA KEV

Apache Tomcat Denial of Service via invalid HTTP priority headerGHSA-3p2h-wqq4-wf4h

Fix: apache/tomcat@1eef1dc

GHSA-3p2h-wqq4-wf4h is a CWE-459 vulnerability in org.apache.tomcat:tomcat-coyote. 2 public exploit or proof-of-concept references are indexed, so weaponization risk is real. A fix is available for org.apache.tomcat:tomcat-coyote — see the affected versions and patch details below.

Also known asBIT-tomcat-2025-31650CVE-2025-31650
Published
Updated
Affected
8 pkgs
Patched
6 / 8
Exploits
2 known
Exploitation data as of Nov 7, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for GHSA-3p2h-wqq4-wf4h.

EPSS Exploitation Probability

via FIRST.org ↗
61.3%probability of exploitation in next 30 days
High Risk0.00%
Lower risk than most CVEs99th percentile — riskier than 99% of all scored CVEsHighest risk
0.00%28.0%56.1%84.1%9.5%61.3%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

8 pkgs affected
☕org.apache.tomcat:tomcat-coyote☕org.apache.tomcat:tomcat-coyote☕org.apache.tomcat:tomcat-coyote☕org.apache.tomcat.embed:tomcat-embed-core☕org.apache.tomcat.embed:tomcat-embed-core☕org.apache.tomcat.embed:tomcat-embed-core☕org.apache.tomcat:tomcat-coyote☕org.apache.tomcat.embed:tomcat-embed-core

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.

This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100.

Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.

Affected Packages

8 total 6 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.apache.tomcat:tomcat-coyote≥ 9.0.76&&< 9.0.1049.0.104org.apache.tomcat:tomcat-coyote:9.0.104
☕Mavenorg.apache.tomcat:tomcat-coyote≥ 10.1.10&&< 10.1.4010.1.40org.apache.tomcat:tomcat-coyote:10.1.40
☕Mavenorg.apache.tomcat:tomcat-coyote≥ 11.0.0-M2&&< 11.0.611.0.6org.apache.tomcat:tomcat-coyote:11.0.6
☕Mavenorg.apache.tomcat.embed:tomcat-embed-core≥ 9.0.76&&< 9.0.1049.0.104org.apache.tomcat.embed:tomcat-embed-core:9.0.104
☕Mavenorg.apache.tomcat.embed:tomcat-embed-core≥ 10.1.10&&< 10.1.4010.1.40org.apache.tomcat.embed:tomcat-embed-core:10.1.40
☕Mavenorg.apache.tomcat.embed:tomcat-embed-core≥ 11.0.0-M2&&< 11.0.611.0.6org.apache.tomcat.embed:tomcat-embed-core:11.0.6

Affected Products

1 product · 27 configurations
Application
tomcatapache
≥ 11.0.1 && < 11.0.6
1 version
11.0.0
Exploits & PoCs
2

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

EDB-52318remotemultiple

Apache Tomcat 10.1.39 - Denial of Service (DoS)

by Abdualhadi khalifa · Jun 5, 2025

Exploit-DB Source

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.apache.tomcat:tomcat-coyote, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update org.apache.tomcat:tomcat-coyote to 9.0.104 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-3p2h-wqq4-wf4h is resolved across your whole dependency graph.

  3. Workarounds

    Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant

This is marked as Important vulnerability rather than a Moderate flaw because it introduces a reliable, unauthenticated denial-of-service (DoS) vector that exploits the core request-handling mechanism in Apache Tomcat. Specifically, the improper handling of invalid HTTP/2 Priority headers results in incomplete memory…

Workaround published by Red Hat
Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.
Source: Red Hat security advisory for GHSA-3p2h-wqq4-wf4h (CC BY 4.0)
ProductFixed inAdvisory
Red Hat Enterprise Linux 10tomcat9-1:9.0.87-5.el10_0.1RHSA-2025:11332
Red Hat Enterprise Linux 10tomcat-1:10.1.49-1.el10RHSA-2026:18537
Red Hat Enterprise Linux 8tomcat-1:9.0.87-1.el8_10.4RHSA-2025:11333
Red Hat Enterprise Linux 8.8 Telecommunications Update Servicetomcat-1:9.0.87-1.el8_8.5RHSA-2025:11382
Red Hat Enterprise Linux 9tomcat-1:9.0.87-3.el9_6.1RHSA-2025:11335
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutionstomcat-1:9.0.87-1.el9_2.4RHSA-2025:11381
Red Hat Enterprise Linux 9.4 Extended Update Supporttomcat-1:9.0.87-1.el9_4.4RHSA-2025:11334
Red Hat JBoss Web Server 5tomcatRHSA-2025:4522

Frequently Asked Questions

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100. Users are recommended to upgrade to version 9.0.
O3 Security · Impact-Aware SCA

Is GHSA-3p2h-wqq4-wf4h in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works
Apache Tomcat Denial of Service via invalid HTTP priority…