CVE-2026-78383: Apache Tomcat: AJP DoS via missing request body
Unauthenticated AJP requests can pin Apache Tomcat threads and cause denial of service.
CVE-2026-78383 is an important-severity denial of service in Apache Tomcat's AJP connector. An unauthenticated AJP request that omits its body can pin an AJP processing thread through unbounded resource allocation. Affected versions run from 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109. The disclosure does not report exploitation in the wild.
- Important unauthenticated AJP denial of service pins a worker thread
- A request missing its body allocates resources without throttling
- Affects Tomcat 7.0 through 11.0 up to the listed versions
- Advisory does not report active exploitation
- CVEs
- CVE-2026-78383
- Vendors
- Apache
- Products
- Apache Tomcat
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-78383 | Unauthenticated AJP Thread-Pinning DoS in Apache Tomcat 7.x–11.x | 7.5 | — |
From the original article
Posted by Mark Thomas on Sep 23 Severity: important Affected versions: - Apache Tomcat 11. 0. 0-M1 through 11.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.