b1gn0se/tomcat-cve-2025-31650Proof-of-concept exploit for Apache Tomcat HTTP/2 DoS vulnerability (CVE-2025-31650). Sends malformed priority headers to trigger memory exhaustion. Includes check-only mode for safe detection and adjustable async intensity.
🚨 Proof of Concept (PoC) for Apache Tomcat HTTP/2 DoS vulnerability (CVE-2025-31650)
This script triggers a memory exhaustion condition in Apache Tomcat by sending malformed priority headers over HTTP/2.
Server header inspection (detect Tomcat)--check-only mode (non-intrusive)python3 PoC.py --target https://example.com:8443 --check-only
python3 PoC.py --target https://example.com:8443 --exploit --tasks 50 --requests 5000
| Parameter | Description |
|---|---|
--target | Full target URL with protocol and port |
--check-only | Only test if the server supports HTTP/2 & Tomcat |
--exploit | Run the actual DoS attack |
--tasks | Number of async tasks (default: 50) |
--requests | Requests per task (default: 5000) |
This PoC is for educational and authorized security testing only.
Do not use it against systems without explicit permission.