# CVE-2026-78383: Apache Tomcat resource exhaustion in AJP connector

Source: https://junglewise.ai/threats/cve-2026-78383-allocation-of-resources-without-limits-or-throttling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-78383 · Severity: high · CVSS 7.5 · Published 2026-09-23

Apache Tomcat is a Java-based web server used to run web applications. An attacker can send specially crafted requests through Tomcat's AJP protocol connector without authentication, causing processing threads to hang and eventually exhausting the server's capacity to handle legitimate requests, resulting in denial of service.

Technologies: [Apache Tomcat](https://junglewise.ai/threats/technologies/tomcat). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-78383 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78383 being exploited in the wild.

**How severe is CVE-2026-78383?** High severity, with a CVSS score of 7.5, published 23 September 2026.

**Which products and versions are affected?** Apache Tomcat 9.0.0-M1 through 9.0.121; 10.1.0-M1 through 10.1.59; 11.0.0-M1 through 11.0.25; also 7.0.0 through 7.0.109 and 8.5.0 through 8.5.100 (EOL).

**Is there a fix for CVE-2026-78383?** A patch was published on 2026-09-23: Fixed in versions 9.0.122, 10.1.60, and 11.0.26 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78383 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-78383?** Check whether you run Apache Tomcat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An allocation of resources without limits or throttling vulnerability in the AJP protocol handler allows unauthenticated requests with missing request bodies to pin AJP processing threads indefinitely. The vulnerability is reachable over the network on the AJP port without prior authentication. Successful exploitation leads to thread exhaustion and denial of service when attackers exhaust the thread pool.

## Affected products

- Apache Tomcat 9.0.0-M1 through 9.0.121; 10.1.0-M1 through 10.1.59; 11.0.0-M1 through 11.0.25; also 7.0.0 through 7.0.109 and 8.5.0 through 8.5.100 (EOL)

## Timeline

- 2026-09-23: disclosed
- 2026-09-23: patched: Fixed in versions 9.0.122, 10.1.60, and 11.0.26

## References

- [https://lists.apache.org/thread/tyqcqk99g7ghgk22641vf67vghcyswnw](https://lists.apache.org/thread/tyqcqk99g7ghgk22641vf67vghcyswnw)
- [http://www.openwall.com/lists/oss-security/2026/09/23/25](http://www.openwall.com/lists/oss-security/2026/09/23/25)

## Related threats

- [Apache Tomcat Jakarta Security credential handler bypass](https://junglewise.ai/threats/cve-2026-111248-the-jakarta-security-identity-store-backed-by-the-tomcat-user)
- [Apache Tomcat incomplete cleanup in TLS 1.3 connections](https://junglewise.ai/threats/cve-2026-93446-incomplete-cleanup-vulnerability-in-apache-tomcat-could-cause-tls)
- [Apache Tomcat HTTP trailer information leak between requests](https://junglewise.ai/threats/cve-2026-88041-incomplete-cleanup-vulnerability-in-apache-tomcat-allowed-an)
- [Apache Tomcat TOCTOU race condition in APR/Native connector](https://junglewise.ai/threats/cve-2026-80353-time-of-check-time-of-use-toctou-race-condition-vulnerability-in)
- [Apache Tomcat Execution After Redirect vulnerability](https://junglewise.ai/threats/cve-2026-74049-execution-after-redirect-ear-vulnerability-in-apache-tomcat-this)