CVE-2026-77762: Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request
Apache Tomcat race lets a stale HPACK emitter inject trailers into another recycled request.
Mark Thomas disclosed CVE-2026-77762, a low-severity race condition in Apache Tomcat. A stale HPACK emitter can inject trailer fields into another request that reuses a pooled Request object. Affected ranges include Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.39 through 9.0.121, the 8.5 line through 8.5.100, and releases through 7.0.109. No in-the-wild exploitation is reported.
- Low-severity race condition in Apache Tomcat HPACK handling.
- A stale emitter can inject trailers into a recycled pooled request.
- Affects Tomcat 11.0, 10.1, 9.0, 8.5, and 7.0 ranges.
- The advisory does not report exploitation in the wild.
- CVEs
- CVE-2026-77762
- Vendors
- Apache
- Products
- Apache Tomcat
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-77762 | HTTP/2 Trailer Injection Race Condition in Apache Tomcat | 8.1 | — |
From the original article
Posted by Mark Thomas on Sep 23 Severity: low Affected versions: - Apache Tomcat 11. 0. 0-M1 through 11.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.