CVE-2026-77762: Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request
Apache Tomcat race lets a stale HPACK emitter inject trailers into another recycled request.
Mark Thomas disclosed CVE-2026-77762, a low-severity race condition in Apache Tomcat. A stale HPACK emitter can inject trailer fields into another request that reuses a pooled Request object. Affected ranges include Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.39 through 9.0.121, the 8.5 line through 8.5.100, and releases through 7.0.109. No in-the-wild exploitation is reported.
- Low-severity race condition in Apache Tomcat HPACK handling.
- A stale emitter can inject trailers into a recycled pooled request.
- Affects Tomcat 11.0, 10.1, 9.0, 8.5, and 7.0 ranges.
- The advisory does not report exploitation in the wild.
Vulnerabilities mentionedAll →
- CVE-2026-777628.1—HTTP/2 Trailer Injection Race Condition in Apache Tomcatpublished · Apache Tomcat
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-77762 | HTTP/2 Trailer Injection Race Condition in Apache Tomcat A race condition in Apache Tomcat allows an attacker to inject HTTP/2 trailer fields into another request. This flaw arises from improper synchronization when using shared resources. A successful attack could lead to request smuggling or other HTTP protocol-level attacks, potentially compromising the confidentiality and integrity of user data. The vulnerability affects multiple active and some end-of-life versions of Tomcat. No public proof-of-concept or known in-the-wild exploitation has been reported. Do: Upgrade Apache Tomcat to version 11.0.26, 10.1.60, or 9.0.122. If you are running an unsupported version (8.5.x or earlier), consider migrating to a supported release. No other specific mitigations are provided. |
Posted by Mark Thomas on Sep 23 Severity: low Affected versions: - Apache Tomcat 11.0.0-M1 through 11.0.25 - Apache Tomcat 10.1.0-M1 through 10.1.59 - Apache Tomcat 9.0.39 through 9.0.121 - Apache Tomcat 8.56.59 through 8.5.100 - Apache Tomcat through 7.0.109 unaffected Description: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another...
This source does not provide full text. Read it at seclists.org.