Apache Tomcat 11.0.26 Fixes 12 Security Flaws Enabling WebSocket Bypass and DoS Attacks
Apache Tomcat 11.0.26 patches 12 flaws, including a WebSocket access-control bypass and several DoS bugs.
68
Vulnerability6 · 4 reads
CVE-2026-77762
HTTP/2 Trailer Injection Race Condition in Apache Tomcat
- CVSS 3.1
- 8.1 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A race condition in Apache Tomcat allows an attacker to inject HTTP/2 trailer fields into another request. This flaw arises from improper synchronization when using shared resources. A successful attack could lead to request smuggling or other HTTP protocol-level attacks, potentially compromising the confidentiality and integrity of user data. The vulnerability affects multiple active and some end-of-life versions of Tomcat. No public proof-of-concept or known in-the-wild exploitation has been reported.
What to do: Upgrade Apache Tomcat to version 11.0.26, 10.1.60, or 9.0.122. If you are running an unsupported version (8.5.x or earlier), consider migrating to a supported release. No other specific mitigations are provided.
| Product | Affected |
|---|---|
| Apache Tomcat | from 11.0.0-M1 through 11.0.25 |
| Apache Tomcat | from 10.1.0-M1 through 10.1.59 |
| Apache Tomcat | from 9.0.39 through 9.0.121 |
| Apache Tomcat | from 8.5.59 through 8.5.100 (EOL) |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.39 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fix the issue.
- Weakness
- CWE-362
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
3 storiesApache Tomcat Update Fixes WebSocket and HTTP/2 Flaws Affecting Server Security
Apache Tomcat 11.0.26 patches 12 flaws, including WebSocket smuggling and an HTTP/2 header mix-up.
68
CVE-2026-77762: Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request
Apache Tomcat race lets a stale HPACK emitter inject trailers into another recycled request.
34