Executive brief
Apache Tomcat is a widely-used web server that handles HTTP requests for applications. A malformed HTTP/2 request can trigger incomplete resource cleanup, causing legitimate requests from other users to fail. This creates a denial of service condition where attackers can disrupt service for other users by sending specially crafted requests.
Technical details
An incomplete cleanup vulnerability in Tomcat's HTTP/2 request handling allows a malformed request to leave resources in an inconsistent state, which can cause subsequent requests from other users to fail depending on timing. The vulnerability is triggered via network-based HTTP/2 requests and requires no authentication or user interaction. An attacker can disrupt availability for other users without gaining direct access to their data.
Affected products
- Apache Tomcat 11.0.19 through 11.0.25, 10.1.53 through 10.1.59, 9.0.116 through 9.0.121
Timeline
- 2026-09-23: disclosed
- 2026-09-23: patched: Fixes available in versions 11.0.26, 10.1.60, 9.0.122