Apache Tomcat 9.0.0.M1 < 9.0.104 multiple vulnerabilities

This Tenable plugin (235034) bundles two CVEs fixed in Apache Tomcat 9.0.104. CVE-2025-31651 is a RewriteValve bypass (CWE-116) affecting versions 9.0.0.M1 through 9.0.102 — but it only works when the RewriteValve is configured with a *subset of unlikely rewrite rule configurations* that also happen to enforce security constraints. Most Tomcat deployments do not use the RewriteValve at all (preferring mod_rewrite in Apache httpd or nginx upstream). CVE-2025-31650 is an unauthenticated DoS via malformed HTTP/2 priority headers that causes a memory leak leading to OutOfMemoryException, affecting the narrower range of 9.0.76–9.0.102.

The vendor severity is wildly misaligned with reality. Tenable's plugin inherits a CVSS 3.0 base of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) for CVE-2025-31651, implying full CIA impact — which is flatly wrong for a rewrite-rule bypass that cannot achieve code execution. Apache themselves rate CVE-2025-31651 as Low severity. Even Tenable's own VPR model disagrees with the CRITICAL label, scoring the plugin at 4.9 (Medium). The more realistic threat here is CVE-2025-31650 at CVSS 7.5, but that's availability-only and recoverable with a service restart. Labeling this bundle CRITICAL will burn credibility with your patching teams.

Why this verdict

• CVSS 9.8 is fabricated severity. The NVD-assigned vector for CVE-2025-31651 claims C:H/I:H/A:H, implying full system compromise. In reality, the flaw bypasses rewrite rules — it cannot execute code, read arbitrary files, or crash the server. Apache's own advisory rates it Low. Tenable's VPR (4.9) quietly agrees.
• Configuration prerequisite severely narrows exposure. CVE-2025-31651 requires (a) RewriteValve enabled (non-default), (b) a specific subset of 'unlikely' rule patterns, and (c) those rules being the sole security enforcement. Each condition compounds downward — the exploitable population is a small fraction of all Tomcat installs.
• CVE-2025-31650 is the real threat but ceiling is availability-only. Unauthenticated remote DoS via HTTP/2 malformed headers is legitimate and has public PoC. However, impact is bounded to service interruption with recovery on restart. No confidentiality or integrity impact.
• Role multiplier: Tomcat is a general-purpose application server. It is *not* canonically a high-value-role component (not a DC, hypervisor, IdP, CA, or network edge). Some instances host critical apps, but neither CVE enables domain takeover, fleet compromise, or supply-chain pivot. The DoS impact on a production Tomcat is real but bounded to that application tier — it does not cascade to identity or infrastructure control planes. No floor elevation triggered.
• No exploitation pressure. Neither CVE is in CISA KEV, no campaigns reported, and the EPSS 90th percentile for CVE-2025-31651 reflects the inflated CVSS anchor rather than real-world weaponization signals.

Why not higher?

A HIGH rating would be warranted if CVE-2025-31651 worked on default configurations or could chain to code execution, or if CVE-2025-31650 caused persistent data loss rather than recoverable DoS. Neither condition holds. The rewrite bypass requires an unlikely non-default configuration that Apache themselves dismiss as Low, and the DoS is recoverable with a restart. No active exploitation or KEV listing provides upward pressure.

Why not lower?

A LOW or IGNORE rating would undercount CVE-2025-31650, which is a genuinely unauthenticated, low-complexity remote DoS with public PoC scripts targeting HTTP/2. For internet-facing Tomcat instances without upstream WAF protection, this is a real availability risk. The 7.5 CVSS for the DoS component is fair and prevents dropping below MEDIUM.

1. Deploy WAF rules to reject malformed HTTP/2 priority headers — This directly mitigates CVE-2025-31650 by blocking the DoS vector at the edge before it reaches Tomcat. Most modern WAFs (Cloudflare, AWS WAF, F5 ASM, ModSecurity) can inspect HTTP/2 frame validity. No mitigation SLA applies at MEDIUM — go straight to the 365-day remediation window.
2. Disable HTTP/2 on Tomcat connectors if not required — CVE-2025-31650 specifically targets HTTP/2 priority header handling. If your Tomcat instances only serve HTTP/1.1 (common when behind a reverse proxy that terminates HTTP/2), the DoS vector is eliminated entirely.
3. Audit and remove RewriteValve usage — CVE-2025-31651 only affects deployments using Tomcat's RewriteValve. If your team uses nginx or Apache httpd for URL rewriting (the common pattern), you are not affected. If you do use RewriteValve for security enforcement, migrate those rules to web.xml security constraints or application-layer authorization.
4. Enable JVM heap monitoring and auto-restart — For CVE-2025-31650, configure heap usage alerts (e.g., at 80% of -Xmx) and automated service restart via systemd or your orchestrator. This limits DoS window to minutes rather than hours.

Run this script on each target Tomcat host as any user with read access to the Tomcat installation directory. Example: bash check_tomcat_cve.sh /opt/tomcat or bash check_tomcat_cve.sh /usr/share/tomcat. No root required.

#!/bin/bash
# Check for Apache Tomcat CVE-2025-31651 / CVE-2025-31650
# Usage: bash check_tomcat_cve.sh <CATALINA_HOME>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

CATALINA_HOME="${1:-}"

if [ -z "$CATALINA_HOME" ]; then
  echo "Usage: $0 <CATALINA_HOME>"
  echo "UNKNOWN - no Tomcat path provided"
  exit 2
fi

# Try to get version from version.sh or catalina.jar MANIFEST
if [ -x "$CATALINA_HOME/bin/version.sh" ]; then
  VERSION=$("$CATALINA_HOME/bin/version.sh" 2>/dev/null | grep 'Server number' | awk -F: '{print $2}' | tr -d ' ')
elif [ -f "$CATALINA_HOME/lib/catalina.jar" ]; then
  VERSION=$(unzip -p "$CATALINA_HOME/lib/catalina.jar" META-INF/MANIFEST.MF 2>/dev/null | grep 'Implementation-Version' | awk -F: '{print $2}' | tr -d ' \r')
else
  echo "UNKNOWN - cannot determine Tomcat version at $CATALINA_HOME"
  exit 2
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN - could not parse Tomcat version"
  exit 2
fi

echo "Detected Tomcat version: $VERSION"

# Parse major.minor.patch
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"

# CVE-2025-31651: 9.0.0.M1 - 9.0.102
# CVE-2025-31650: 9.0.76 - 9.0.102
# Fixed in: 9.0.104

if [ "$MAJOR" -eq 9 ] && [ "$MINOR" -eq 0 ]; then
  if [ "$PATCH" -le 102 ]; then
    echo "VULNERABLE - Tomcat $VERSION is affected by CVE-2025-31651 and CVE-2025-31650"
    echo "  CVE-2025-31651 (Rewrite bypass): affects 9.0.0.M1 - 9.0.102"
    if [ "$PATCH" -ge 76 ]; then
      echo "  CVE-2025-31650 (HTTP/2 DoS):    affects 9.0.76 - 9.0.102"
    else
      echo "  CVE-2025-31650 (HTTP/2 DoS):    NOT affected (requires >= 9.0.76)"
    fi
    echo "  Fix: upgrade to 9.0.104 or later"
    exit 1
  else
    echo "PATCHED - Tomcat $VERSION is >= 9.0.104"
    exit 0
  fi
else
  echo "UNKNOWN - this script checks Tomcat 9.0.x only (detected $VERSION)"
  exit 2
fi

Sources

1. Tenable Plugin 235034
2. Apache Tomcat 9 Security Advisories
3. CVE-2025-31651 PoC (gregk4sec)
4. CVE-2025-31650 GitHub Advisory
5. CVE-2025-31651 Red Hat Advisory
6. CVE-2025-31650 Red Hat Bugzilla
7. CVE-2025-31651 MITRE Record
8. CVE-2025-31650 Wiz Analysis