Executive brief
Apache Tomcat is a Java-based web server used to run web applications. An attacker can send specially crafted requests through Tomcat's AJP protocol connector without authentication, causing processing threads to hang and eventually exhausting the server's capacity to handle legitimate requests, resulting in denial of service.
Technical details
An allocation of resources without limits or throttling vulnerability in the AJP protocol handler allows unauthenticated requests with missing request bodies to pin AJP processing threads indefinitely. The vulnerability is reachable over the network on the AJP port without prior authentication. Successful exploitation leads to thread exhaustion and denial of service when attackers exhaust the thread pool.
Affected products
- Apache Tomcat 9.0.0-M1 through 9.0.121; 10.1.0-M1 through 10.1.59; 11.0.0-M1 through 11.0.25; also 7.0.0 through 7.0.109 and 8.5.0 through 8.5.100 (EOL)
Timeline
- 2026-09-23: disclosed
- 2026-09-23: patched: Fixed in versions 9.0.122, 10.1.60, and 11.0.26