CVE-2025-31650

描述

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.

如何修補 CVE-2025-31650

要修補 CVE-2025-31650,請將受影響套件升級到下列已修補版本。

• —升級至 9.0.104 或更新版本
• —升級至 10.1.40-1 或更新版本
• —升級至 11.0.6-1 或更新版本
• —升級至 9.0.107-0+deb11u1 或更新版本
• —升級至 9.0.104 或更新版本
• —升級至 9.0.104 或更新版本

CVE-2025-31650 正在被利用嗎?

可能 — EPSS 為 66.9%,屬於高被利用機率區間,建議優先修補。

受影響套件(6)

• >= 9.0.76, < 9.0.104, >= 10.1.10, < 10.1.40, >= 11.0.0, < 11.0.6
• from 0, < 10.1.40-1
• from 0, < 11.0.6-1
• from 0, < 9.0.107-0+deb11u1
• >= 9.0.76, < 9.0.104
• >= 9.0.76, < 9.0.104

CVSS 分數

參考連結(18)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2025-31650
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2025-31650
• PATCHgithub.com/apache/tomcat
• WEBwww.openwall.com/lists/oss-security/2025/04/28/2
• WEB