Apache Tomcat 11.0.26 Fixes 12 Security Flaws Enabling WebSocket Bypass and DoS Attacks
Apache Tomcat 11.0.26 patches 12 flaws, including a WebSocket access-control bypass and several DoS bugs.
68
Vulnerability15 · 4 reads
CVE-2026-78383
Unauthenticated AJP Thread-Pinning DoS in Apache Tomcat 7.x–11.x
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Tomcat contains an unbounded resource allocation flaw (CWE-770) in its AJP (Apache JServ Protocol, typically port 8009) handling, rated CVSS 3.1 7.5 (high). An unauthenticated attacker who can reach the AJP connector can send a crafted request that pins an AJP processing thread indefinitely; repeating this exhausts the finite AJP thread pool and causes denial of service for legitimate traffic. Only availability is impacted — there is no confidentiality or integrity effect. The issue spans all supported lines (9.x, 10.1.x, 11.x previews through their latest releases) plus EOL 7.0.x and 8.5.x, and is fixed in 11.0.26, 10.1.60, and 9.0.122. There is no known public PoC, no evidence of in-the-wild exploitation, and it is not in the CISA KEV catalog.
What to do: Upgrade to Tomcat 11.0.26, 10.1.60, or 9.0.122; if you are on EOL 7.0.x or 8.5.x, migrate to a supported line since no patches will be issued. If the AJP connector is not required, disable or comment it out in server.xml; otherwise bind it to an internal interface, firewall port 8009 so only trusted load balancers can reach it, and require the AJP secret/shared key. Monitor AJP thread pool utilization for unexplained pinned or exhausted threads.
| Product | Affected |
|---|---|
| Apache Tomcat | 11.0.0-M1 through 11.0.25 |
| Apache Tomcat | 10.1.0-M1 through 10.1.59 |
| Apache Tomcat | 9.0.0.M1 through 9.0.121 |
| Apache Tomcat | 8.5.0 through 8.5.100 (EOL, known affected) |
| Apache Tomcat | 7.0.0 through 7.0.109 (EOL, known affected) |
Estimated exposure
massMillions of Tomcat deployments overall; on the order of 100,000+ internet-reachable AJP (port 8009) endpoints, plus a larger internal population with AJP… — Tomcat is one of the most widely deployed Java servlet containers, and public internet scans (Shodan/Censys) have historically shown roughly 10^5 hosts with an AJP port open, while deployments with AJP enabled only on internal networks are…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
- Weakness
- CWE-770
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
In the news
3 storiesApache Tomcat Update Fixes WebSocket and HTTP/2 Flaws Affecting Server Security
Apache Tomcat 11.0.26 patches 12 flaws, including WebSocket smuggling and an HTTP/2 header mix-up.
68
CVE-2026-78383: Apache Tomcat: AJP DoS via missing request body
Unauthenticated AJP requests can pin Apache Tomcat threads and cause denial of service.
52