CVE-2026-78437: Apache Tomcat: HTTP/2 DoS via malformed request
A low-severity Apache Tomcat HTTP/2 flaw can fail another user's request after malformed input.
CVE-2026-78437 is a low-severity incomplete-cleanup flaw in Apache Tomcat HTTP/2 processing. A malformed request can, depending on timing, cause one request from another user to fail. Affected versions are 11.0.19 through 11.0.25, 10.1.53 through 10.1.59, and 9.0.116 through 9.0.121. Tomcat through 8.5.100 is unaffected, and no exploitation is reported.
- Low-severity HTTP/2 cleanup bug can fail another user's request
- Impact depends on timing rather than taking down the server
- Affects limited Tomcat 9.0, 10.1, and 11.0 ranges
- Tomcat through 8.5.100 is unaffected
Vulnerabilities mentionedAll →
- CVE-2026-784377.3—Incomplete Cleanup in Apache Tomcat Causes Cross-User Request Failure via HTTP/2published · Apache Tomcat
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-78437 | Incomplete Cleanup in Apache Tomcat Causes Cross-User Request Failure via HTTP/2 Apache Tomcat contains an incomplete cleanup flaw (CWE-459) in which a malformed request — over HTTP/2, per the related advisory headline — leaves stale state behind that is not fully cleared before the connection or request object is reused. Depending on timing, this residual state can cause a subsequent request from a different user to fail, a cross-user denial of service. The attacker gains only the ability to degrade or break other users' requests, not code execution or data disclosure. Affected deployments are Tomcat 11.0.19–11.0.25, 10.1.53–10.1.59, and 9.0.116–9.0.121, with fixes in 11.0.26, 10.1.60, and 9.0.122. No CVSS score has been assigned yet, the flaw is not in the CISA KEV catalog, and no public proof of concept or observed exploitation is known. |
Posted by Mark Thomas on Sep 23 Severity: low Affected versions: - Apache Tomcat 11.0.19 through 11.0.25 - Apache Tomcat 10.1.53 through 10.1.59 - Apache Tomcat 9.0.116 through 9.0.121 - Apache Tomcat through 8.5.100 unaffected Description: Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail. This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53...
This source does not provide full text. Read it at seclists.org.