A proof-of-concept denial-of-service (DoS) exploit targeting a critical security flaw in Apache Tomcathas been released, exposing servers running versions 10.1.10 to 10.1.39 to potential attacks.
See also: Hackers exploit Apache Tomcat RCE vulnerability
The exploit, designated CVE-2025-31650, uses malformed HTTP/2 priority headers to cause a memory leak in vulnerable Tomcat installations. Security researcher Abdualhadi Khalifa developed and published the attack code on June 5, 2025, marking a significant development in the ongoing security challenges facing web application.
The vulnerability exploits a fundamental flaw in the way Apache Tomcat handles HTTP/2 priority headers, specifically targeting the server's memory management system. The attack method relies on sending specially crafted requests with invalid priority parameters, which bypass normal validation mechanisms, causing gradual memory leaks in the Tomcat runtime.
The exploit leverages a complex set of malformed priority headers, including extreme numerical values such as u=-1, q=2, u=4294967295, q=-1 , and u=-2147483648, q=1.5. These values are designed to trigger edge cases in Tomcat's HTTP/2 implementation, where the server fails to properly release memory resources after processing malformed requests.
See also: Vulnerability in Apache Tomcat allows Dos attacks
The attack methodology involves launching parallel asynchronous processes, which flood the targeted server with thousands of specially crafted requests.
The exploit, which is written in Python , uses the httpx library with HTTP/2 support enabled , and implements a class named TomcatKiller that manages the execution of the attack. The code demonstrates advanced evasion techniques , such as random user-agent strings and dynamic header manipulation , in order to bypass basic detection mechanisms.
A critical factor in the success of the attack is the initial confirmation that the server supports HTTP/2 , as the vulnerability exclusively affects the HTTP/2 protocol stack .
The Apache Tomcat DoS attack is proving to be particularly destructive, as it targets memory resources rather than network bandwidth, which makes it difficult to deal with through traditional DDoS protection mechanisms .
When successfully executed, the exploit can cause Apache Tomcat servers to consume excessive amounts of memory , ultimately leading to OutOfMemoryError exceptions and a complete service shutdown
By default, the tool runs 300 concurrent processes, each of which sends up to 100,000 requests with malformed priority headers.
See also: RCE vulnerability in Apache Struts 2 puts servers at risk
A related and important point worth mentioning is that this vulnerability highlights the challenges that accompany the adoption of the HTTP/2 protocol in modern web servers such as Apache Tomcat. While HTTP/2 offers significant performance benefits, such as faster data transfer and support for multiple streams per connection, it also introduces new attack surfaces, particularly when the protocol implementation does not properly handle “edge cases” such as priority headers.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Source: cybersecuritynews
