HTTP/2 Trailer Injection Race Condition in Apache Tomcat
CVSS 3.1
8.1high
EPSS
—
Published
()
Modified
AI analysis
A race condition in Apache Tomcat allows an attacker to inject HTTP/2 trailer fields into another request. This flaw arises from improper synchronization when using shared resources. A successful attack could lead to request smuggling or other HTTP protocol-level attacks, potentially compromising the confidentiality and integrity of user data. The vulnerability affects multiple active and some end-of-life versions of Tomcat. No public proof-of-concept or known in-the-wild exploitation has been reported.
What to do: Upgrade Apache Tomcat to version 11.0.26, 10.1.60, or 9.0.122. If you are running an unsupported version (8.5.x or earlier), consider migrating to a supported release. No other specific mitigations are provided.
Affected
Apache Tomcat
from 11.0.0-M1 through 11.0.25
Apache Tomcat
from 10.1.0-M1 through 10.1.59
Apache Tomcat
from 9.0.39 through 9.0.121
Apache Tomcat
from 8.5.59 through 8.5.100 (EOL)
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.39 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fix the issue.
Apache Tomcat 11.0.26 patches 12 flaws, including a WebSocket access-control bypass and several DoS bugs.
Apache Tomcat 11.0.26, dated September 15, 2026, fixes 12 vulnerabilities that were publicly disclosed on September 23. CVE-2026-76183, rated Important, can bypass security constraints on WebSocket endpoints in every 11.0 build from 11.0.0-M1 through 11.0.25. The release also fixes WebSocket and AJP denial-of-service flaws, including CVE-2026-78383 and CVE-2026-77791, and an HTTP/2 request-header mix-up tracked as CVE-2026-86350. Apache does not ship binary patches and advises upgrading from 11.0.25 or earlier.
Apache Tomcat 11.0.26 patches 12 flaws, including WebSocket smuggling and an HTTP/2 header mix-up.
Apache released Tomcat 11.0.26 on September 23, 2026, fixing 12 vulnerabilities across WebSocket, HTTP/2, AJP, authentication, and TLS validation. Four are rated Important, three Moderate, and five Low; most affect 11.0.0-M1 through 11.0.25. CVE-2026-87022 can smuggle WebSocket messages when per-message-deflate is enabled, and CVE-2026-86350 can mix up HTTP/2 request headers. CVE-2026-76183 is an Important WebSocket authorization bypass. Apache advises upgrading to 11.0.26; no exploitation is reported.
Apache Tomcat race lets a stale HPACK emitter inject trailers into another recycled request.
Mark Thomas disclosed CVE-2026-77762, a low-severity race condition in Apache Tomcat. A stale HPACK emitter can inject trailer fields into another request that reuses a pooled Request object. Affected ranges include Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.39 through 9.0.121, the 8.5 line through 8.5.100, and releases through 7.0.109. No in-the-wild exploitation is reported.