Junglewise Threat Intelligence

CVE-2026-78437: Apache Tomcat incomplete cleanup denial of service in HTTP/2

CVE-2026-78437 · Severity: high · CVSS 7.3 · Published 2026-09-23

Technologies: Apache Tomcat. Vendors: Apache.

Executive brief

Apache Tomcat is a widely-used web server that handles HTTP requests for applications. A malformed HTTP/2 request can trigger incomplete resource cleanup, causing legitimate requests from other users to fail. This creates a denial of service condition where attackers can disrupt service for other users by sending specially crafted requests.

Technical details

An incomplete cleanup vulnerability in Tomcat's HTTP/2 request handling allows a malformed request to leave resources in an inconsistent state, which can cause subsequent requests from other users to fail depending on timing. The vulnerability is triggered via network-based HTTP/2 requests and requires no authentication or user interaction. An attacker can disrupt availability for other users without gaining direct access to their data.

Affected products

  • Apache Tomcat 11.0.19 through 11.0.25, 10.1.53 through 10.1.59, 9.0.116 through 9.0.121

Timeline

  • 2026-09-23: disclosed
  • 2026-09-23: patched: Fixes available in versions 11.0.26, 10.1.60, 9.0.122

References

Related threats