Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame

Summary

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.

Timeline

1. Apr 28, 2025, 7:14 PM UTCCVE published
2. May 6, 2025, 8:07 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Jun 5, 2025Public exploit on Exploit-DB

   EDB-52318

4. Nov 3, 2025, 7:53 PM UTCRecord last updated
5. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Apache Software Foundation Apache Tomcat

  From 9.0.76 · through 9.0.102; From 10.1.10 · through 10.1.39; From 11.0.0-M2 · through 11.0.5; From 8.5.90 · through 8.5.100

• org.apache.tomcat:tomcat-coyoteMaven

  From 9.0.76 · fixed in 9.0.104

• org.apache.tomcat:tomcat-coyoteMaven

  From 10.1.10 · fixed in 10.1.40

• org.apache.tomcat:tomcat-coyoteMaven

  From 11.0.0-M2 · fixed in 11.0.6

• org.apache.tomcat.embed:tomcat-embed-coreMaven

  From 9.0.76 · fixed in 9.0.104

• org.apache.tomcat.embed:tomcat-embed-coreMaven

  From 10.1.10 · fixed in 10.1.40

• org.apache.tomcat.embed:tomcat-embed-coreMaven

  From 11.0.0-M2 · fixed in 11.0.6

• org.apache.tomcat:tomcat-coyoteMaven

  From 8.5.0 · through 8.5.100

• org.apache.tomcat.embed:tomcat-embed-coreMaven

  From 8.5.0 · through 8.5.100

References 8