CVE-2026-78437: Apache Tomcat: HTTP/2 DoS via malformed request
AI summary · grok-4.7Summaries by Vani AI
A low-severity Apache Tomcat HTTP/2 flaw can fail another user's request after malformed input.
CVE-2026-78437 is a low-severity incomplete-cleanup flaw in Apache Tomcat HTTP/2 processing. A malformed request can, depending on timing, cause one request from another user to fail. Affected versions are 11.0.19 through 11.0.25, 10.1.53 through 10.1.59, and 9.0.116 through 9.0.121. Tomcat through 8.5.100 is unaffected, and no exploitation is reported.
Key facts
- Low-severity HTTP/2 cleanup bug can fail another user's request
- Impact depends on timing rather than taking down the server
- Affects limited Tomcat 9.0, 10.1, and 11.0 ranges
- Tomcat through 8.5.100 is unaffected
- CVEs
- CVE-2026-78437
- Vendors
- Apache
- Products
- Apache Tomcat
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-78437 | Incomplete Cleanup in Apache Tomcat Causes Cross-User Request Failure via HTTP/2 | 7.3 | — |
From the original article
Posted by Mark Thomas on Sep 23 Severity: low Affected versions: - Apache Tomcat 11. 0. 19 through 11.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.