CVE-2026-78383: Apache Tomcat: AJP DoS via missing request body
Unauthenticated AJP requests can pin Apache Tomcat threads and cause denial of service.
CVE-2026-78383 is an important-severity denial of service in Apache Tomcat's AJP connector. An unauthenticated AJP request that omits its body can pin an AJP processing thread through unbounded resource allocation. Affected versions run from 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109. The disclosure does not report exploitation in the wild.
- Important unauthenticated AJP denial of service pins a worker thread
- A request missing its body allocates resources without throttling
- Affects Tomcat 7.0 through 11.0 up to the listed versions
- Advisory does not report active exploitation
Vulnerabilities mentionedAll →
- CVE-2026-783837.5—Unauthenticated AJP Thread-Pinning DoS in Apache Tomcat 7.x–11.xpublished · Apache Tomcat
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-78383 | Unauthenticated AJP Thread-Pinning DoS in Apache Tomcat 7.x–11.x Apache Tomcat contains an unbounded resource allocation flaw (CWE-770) in its AJP (Apache JServ Protocol, typically port 8009) handling, rated CVSS 3.1 7.5 (high). An unauthenticated attacker who can reach the AJP connector can send a crafted request that pins an AJP processing thread indefinitely; repeating this exhausts the finite AJP thread pool and causes denial of service for legitimate traffic. Only availability is impacted — there is no confidentiality or integrity effect. The issue spans all supported lines (9.x, 10.1.x, 11.x previews through their latest releases) plus EOL 7.0.x and 8.5.x, and is fixed in 11.0.26, 10.1.60, and 9.0.122. There is no known public PoC, no evidence of in-the-wild exploitation, and it is not in the CISA KEV catalog. |
Posted by Mark Thomas on Sep 23 Severity: important Affected versions: - Apache Tomcat 11.0.0-M1 through 11.0.25 - Apache Tomcat 10.1.0-M1 through 10.1.59 - Apache Tomcat 9.0.0.M1 through 9.0.121 - Apache Tomcat 8.5.0 through 8.5.100 - Apache Tomcat 7.0.0 through 7.0.109 Description: Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This...
This source does not provide full text. Read it at seclists.org.