DEBIAN-CVE-2025-31650

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/DEBIAN-CVE-2025-31650

Import Source

https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-31650.json

JSON Data

https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2025-31650

Upstream

CVE-2025-31650

Published

2025-04-28T20:15:20Z

Modified

2025-09-18T06:33:00.059473Z

Summary

[none]

Details

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.

References

https://security-tracker.debian.org/tracker/CVE-2025-31650

Affected packages

Debian:11

tomcat9

Package

Name: tomcat9
Purl: pkg:deb/debian/tomcat9?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

9.0.107-0+deb11u1

Affected versions

9.*

9.0.43-1

9.0.43-2~deb11u1

9.0.43-2~deb11u2

9.0.43-2~deb11u3

9.0.43-2~deb11u4

9.0.43-2~deb11u5

9.0.43-2~deb11u6

9.0.43-2~deb11u7

9.0.43-2~deb11u8

9.0.43-2~deb11u9

9.0.43-2~deb11u10

9.0.43-2~deb11u11

9.0.43-2~deb11u12

9.0.43-2

9.0.43-3

9.0.53-1

9.0.54-1

9.0.55-1

9.0.58-1

9.0.62-1

9.0.63-1

9.0.64-1

9.0.64-2

9.0.65-1

9.0.67-1

9.0.68-1

9.0.68-1.1

9.0.70-1

9.0.70-2

9.0.95-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12

tomcat10

Package

Name: tomcat10
Purl: pkg:deb/debian/tomcat10?arch=source

Affected ranges

Ecosystem specific

{
    "urgency": "not yet assigned"
}

tomcat9

Package

Name: tomcat9
Purl: pkg:deb/debian/tomcat9?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

9.0.70-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13

tomcat10

Package

Name: tomcat10
Purl: pkg:deb/debian/tomcat10?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

10.1.40-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

tomcat11

Package

Name: tomcat11
Purl: pkg:deb/debian/tomcat11?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

11.0.6-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

tomcat9

Package

Name: tomcat9
Purl: pkg:deb/debian/tomcat9?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

9.0.70-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:14

tomcat10

Package

Name: tomcat10
Purl: pkg:deb/debian/tomcat10?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

10.1.40-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

tomcat11

Package

Name: tomcat11
Purl: pkg:deb/debian/tomcat11?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

11.0.6-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

tomcat9

Package

Name: tomcat9
Purl: pkg:deb/debian/tomcat9?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

9.0.70-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}