Homepage

Improper Input Validation Affecting tomcat10 package, versions <10.1.40-1

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Improper Input Validation vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-DEBIAN13-TOMCAT10-9892594
  • published29 Apr 2025
  • disclosed28 Apr 2025
Report a new vulnerability Found a mistake?

Introduced: 28 Apr 2025

NewCVE-2025-31650  (opens in a new tab)
CWE-20  (opens in a new tab)

How to fix?

Upgrade Debian:13 tomcat10 to version 10.1.40-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream tomcat10 package and not the tomcat10 package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.

This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.

Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.