CVE-2026-78437

Apache Tomcat contains an incomplete cleanup flaw (CWE-459) in which a malformed request — over HTTP/2, per the related advisory headline — leaves stale state behind that is not fully cleared before the connection or request object is reused. Depending on timing, this residual state can cause a subsequent request from a different user to fail, a cross-user denial of service. The attacker gains only the ability to degrade or break other users' requests, not code execution or data disclosure. Affected deployments are Tomcat 11.0.19–11.0.25, 10.1.53–10.1.59, and 9.0.116–9.0.121, with fixes in 11.0.26, 10.1.60, and 9.0.122. No CVSS score has been assigned yet, the flaw is not in the CISA KEV catalog, and no public proof of concept or observed exploitation is known.

What to do: Upgrade to Tomcat 11.0.26, 10.1.60, or 9.0.122 (or later) on every affected stream. Verify actual running versions with version.sh / RELEASE-NOTES or your packaging manager, and remember Tomcat is often embedded in Java applications, so patch those dependencies too. Until patched, consider disabling the HTTP/2 upgrade protocol on connectors where it is not required and monitor access/error logs for malformed requests followed by unexplained request failures.