Bug 2362783 (CVE-2025-31650)
| Summary: | CVE-2025-31650 tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | aogburn, cchiang, csutherl, jclere, pdelbell, pjindal, plodge, prodsec-dev, szappis, vrajput |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | Flags: | szappis:
needinfo?
(pdelbell) aogburn: needinfo? (prodsec-dev) aogburn: needinfo? (pdelbell) |
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Apache Tomcat. This vulnerability allows an application-level denial of service (DoS), causing it to become unresponsive or slow via maliciously crafted HTTP/2 prioritization headers. It performs an incomplete cleanup of failed requests, which triggers a memory leak.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2363043, 2363044, 2363045 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2025-04-28 20:01:21 UTC
Hi Engineering Team, One of the below account too looking for an update and asking to prioritize the fix for this CVE for RHEL 8: Account Name ACE-IT/LOCKEED MARTIN Account Number 1203914 Thank You!! This issue has been addressed in the following products: Red Hat JBoss Web Server Via RHSA-2025:3609 https://access.redhat.com/errata/RHSA-2025:3609 This issue has been addressed in the following products: Red Hat JBoss Web Server 6.1 on RHEL 8 Red Hat JBoss Web Server 6.1 on RHEL 9 Via RHSA-2025:3608 https://access.redhat.com/errata/RHSA-2025:3608 This issue has been addressed in the following products: Red Hat JBoss Web Server Via RHSA-2025:4522 https://access.redhat.com/errata/RHSA-2025:4522 This issue has been addressed in the following products: Red Hat JBoss Web Server 5.8 on RHEL 7 Red Hat JBoss Web Server 5.8 on RHEL 8 Red Hat JBoss Web Server 5.8 on RHEL 9 Via RHSA-2025:4521 https://access.redhat.com/errata/RHSA-2025:4521 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2025:11332 https://access.redhat.com/errata/RHSA-2025:11332 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2025:11334 https://access.redhat.com/errata/RHSA-2025:11334 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:11335 https://access.redhat.com/errata/RHSA-2025:11335 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2025:11333 https://access.redhat.com/errata/RHSA-2025:11333 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2025:11381 https://access.redhat.com/errata/RHSA-2025:11381 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2025:11382 https://access.redhat.com/errata/RHSA-2025:11382 |