Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
☕ Maven
Not in CISA KEV

GHSA-3p2h-wqq4-wf4h — tomcat-coyote

Fix: apache/tomcat@1eef1dc

GHSA-3p2h-wqq4-wf4h is a CWE-459 vulnerability in org.apache.tomcat:tomcat-coyote. 2 public exploit references exist, so weaponization risk is real. A fix is available for org.apache.tomcat:tomcat-coyote — see the affected versions and patch details below.

Apache Tomcat Denial of Service via invalid HTTP priority header

Also known asBIT-tomcat-2025-31650CVE-2025-31650
Published
Apr 28, 2025
Updated
Sep 10, 2026
Affected
8 pkgs
Patched
6 / 8
Exploits
2 known
Exploitation data as of Sep 24, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for GHSA-3p2h-wqq4-wf4h.

EPSS Exploitation Probability

via FIRST.org ↗
61.0%probability of exploitation in next 30 days
High Risk0.00%
Lower risk than most CVEs99th percentile — riskier than 99% of all scored CVEsHighest risk

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

Real-World Exposure

8 pkgs affected
☕org.apache.tomcat:tomcat-coyote☕org.apache.tomcat:tomcat-coyote☕org.apache.tomcat:tomcat-coyote☕org.apache.tomcat.embed:tomcat-embed-core☕org.apache.tomcat.embed:tomcat-embed-core☕org.apache.tomcat.embed:tomcat-embed-core☕org.apache.tomcat:tomcat-coyote☕org.apache.tomcat.embed:tomcat-embed-core

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.

This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100.

Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.

Affected Packages

8 total 6 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.apache.tomcat:tomcat-coyote≥ 9.0.76&&< 9.0.1049.0.104org.apache.tomcat:tomcat-coyote:9.0.104
☕Mavenorg.apache.tomcat:tomcat-coyote≥ 10.1.10&&< 10.1.4010.1.40org.apache.tomcat:tomcat-coyote:10.1.40
☕Mavenorg.apache.tomcat:tomcat-coyote≥ 11.0.0-M2&&< 11.0.611.0.6org.apache.tomcat:tomcat-coyote:11.0.6
☕Mavenorg.apache.tomcat.embed:tomcat-embed-core≥ 9.0.76&&< 9.0.1049.0.104org.apache.tomcat.embed:tomcat-embed-core:9.0.104
☕Mavenorg.apache.tomcat.embed:tomcat-embed-core≥ 10.1.10&&< 10.1.4010.1.40org.apache.tomcat.embed:tomcat-embed-core:10.1.40
☕Mavenorg.apache.tomcat.embed:tomcat-embed-core≥ 11.0.0-M2&&< 11.0.611.0.6org.apache.tomcat.embed:tomcat-embed-core:11.0.6
Exploits & PoCs
2

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

EDB-52318remotemultiple

Apache Tomcat 10.1.39 - Denial of Service (DoS)

by Abdualhadi khalifa · Jun 5, 2025

Exploit-DB Source

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.apache.tomcat:tomcat-coyote, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update org.apache.tomcat:tomcat-coyote to 9.0.104 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-3p2h-wqq4-wf4h is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-3p2h-wqq4-wf4h can be triaged on real exposure rather than presence alone.

Tailored to GHSA-3p2h-wqq4-wf4h. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant

This is marked as Important vulnerability rather than a Moderate flaw because it introduces a reliable, unauthenticated denial-of-service (DoS) vector that exploits the core request-handling mechanism in Apache Tomcat. Specifically, the improper handling of invalid HTTP/2 Priority headers results in incomplete memory…

ProductFixed inAdvisory
Red Hat Enterprise Linux 10tomcat9-1:9.0.87-5.el10_0.1RHSA-2025:11332
Red Hat Enterprise Linux 8tomcat-1:9.0.87-1.el8_10.4RHSA-2025:11333
Red Hat Enterprise Linux 8.8 Telecommunications Update Servicetomcat-1:9.0.87-1.el8_8.5RHSA-2025:11382
Red Hat Enterprise Linux 9tomcat-1:9.0.87-3.el9_6.1RHSA-2025:11335
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutionstomcat-1:9.0.87-1.el9_2.4RHSA-2025:11381
Red Hat Enterprise Linux 9.4 Extended Update Supporttomcat-1:9.0.87-1.el9_4.4RHSA-2025:11334
Red Hat JBoss Web Server 5tomcatRHSA-2025:4522
Red Hat JBoss Web Server 5.8 on RHEL 7jws5-tomcat-0:9.0.87-11.redhat_00010.1.el7jwsRHSA-2025:4521
UbuntuHIGH
USN-7705-1Ubuntu

Frequently Asked Questions

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100. Users are recommended to upgrade to version 9.0.
O3 Security · Impact-Aware SCA

Is GHSA-3p2h-wqq4-wf4h in your dependencies?

O3 Security finds GHSA-3p2h-wqq4-wf4h across Maven dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.

Scan my dependencies How O3 SCA works
GHSA-3p2h-wqq4-wf4h: tomcat-coyote DoS | O3 Security