Is CVE-2026-77762 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77762 being exploited in the wild.

How severe is CVE-2026-77762?

High severity, with a CVSS score of 8.1, published 23 September 2026.

Which products and versions are affected?

Apache Tomcat 8.5.59 through 8.5.100 (end-of-life at disclosure).

Is there a fix for CVE-2026-77762?

A patch was published on 2026-09-23: Fixed in versions 9.0.122, 10.1.60, 11.0.26 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77762 attacked?

It is attacked over the network.

Am I affected by CVE-2026-77762?

Check whether you run Apache Tomcat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77762: Apache Tomcat HTTP/2 trailer field injection race condition

CVE-2026-77762 · Severity: high · CVSS 8.1 · Published 2026-09-23

Apache Tomcat, a widely-used web application server, contains a race condition in its HTTP/2 request handling that allows an attacker to inject trailer fields into another user's request. An attacker could exploit this to inject malicious headers into concurrent requests from other users, potentially leading to header spoofing, authentication bypass, or unauthorized data modification depending on how the application processes these headers.

Technologies: Apache Tomcat. Vendors: Apache.

Quick answers

Is CVE-2026-77762 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77762 being exploited in the wild.
How severe is CVE-2026-77762?: High severity, with a CVSS score of 8.1, published 23 September 2026.
Which products and versions are affected?: Apache Tomcat 8.5.59 through 8.5.100 (end-of-life at disclosure).
Is there a fix for CVE-2026-77762?: A patch was published on 2026-09-23: Fixed in versions 9.0.122, 10.1.60, 11.0.26 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77762 attacked?: It is attacked over the network.
Am I affected by CVE-2026-77762?: Check whether you run Apache Tomcat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A race condition in the HPACK emitter causes a stale emitter state to be reused across recycled pooled requests in HTTP/2 connections. An attacker on the network can craft concurrent HTTP/2 requests to inject trailer fields into another in-flight request by exploiting improper synchronization of shared resources. This requires network-level access and precise timing but no authentication; successful exploitation allows header injection that could be processed by downstream application logic.

Affected products

Apache Tomcat 9.0.39 through 9.0.121
Apache Tomcat 10.1.0-M1 through 10.1.59
Apache Tomcat 11.0.0-M1 through 11.0.25
Apache Tomcat 8.5.59 through 8.5.100 (end-of-life at disclosure)

Timeline

2026-09-23: disclosed
2026-09-23: patched: Fixed in versions 9.0.122, 10.1.60, 11.0.26

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.