Executive brief
Apache Tomcat, a widely-used web application server, contains a race condition in its HTTP/2 request handling that allows an attacker to inject trailer fields into another user's request. An attacker could exploit this to inject malicious headers into concurrent requests from other users, potentially leading to header spoofing, authentication bypass, or unauthorized data modification depending on how the application processes these headers.
Technical details
A race condition in the HPACK emitter causes a stale emitter state to be reused across recycled pooled requests in HTTP/2 connections. An attacker on the network can craft concurrent HTTP/2 requests to inject trailer fields into another in-flight request by exploiting improper synchronization of shared resources. This requires network-level access and precise timing but no authentication; successful exploitation allows header injection that could be processed by downstream application logic.
Affected products
- Apache Tomcat 9.0.39 through 9.0.121
- Apache Tomcat 10.1.0-M1 through 10.1.59
- Apache Tomcat 11.0.0-M1 through 11.0.25
- Apache Tomcat 8.5.59 through 8.5.100 (end-of-life at disclosure)
Timeline
- 2026-09-23: disclosed
- 2026-09-23: patched: Fixed in versions 9.0.122, 10.1.60, 11.0.26