CVE-2026-78437 Apache Tomcat: HTTP/2 DoS via malformed request
HighCVSS 7.3
EPSS 0.51%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail.
This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121.
Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat/tomcat10-main(Red Hat:hummingbird:1) | < 10.1.60-0.1.hum1 | 10.1.60-0.1.hum1 |
| redhat/tomcat11-main(Red Hat:hummingbird:1) | < 11.0.26-0.1.hum1 | 11.0.26-0.1.hum1 |
| redhat/tomcat9(Red Hat:enterprise_linux:10) | All versions | No fix listed |
| redhat/tomcat6(Red Hat:rhel_els:6) | All versions | No fix listed |
| redhat/tomcat(Red Hat:rhel_els:7) | All versions | No fix listed |
| redhat/tomcat(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/tomcat(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/jws6-tomcat(Red Hat:jboss_enterprise_web_server:6) | All versions | No fix listed |
| redhat/jws7-tomcat(Red Hat:jboss_enterprise_web_server:7) | All versions | No fix listed |
| Apache Tomcat | >= 11.0.19, <= 11.0.25 | No fix listed |
| Apache Tomcat | >= 10.1.53, <= 10.1.59 | No fix listed |
| Apache Tomcat | >= 9.0.116, <= 9.0.121 | No fix listed |
| debian/tomcat10(Debian:12) | All versions | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.10-1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.13-1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.14-1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.15-1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.16-1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.20-1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.23-1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.25-1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.25-1~bpo12+1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.25-2 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.30-1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.30-1~bpo12+1 | No fix listed |
Show 82 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/tomcat10(Debian:12) | = 10.1.31-1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.33-1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.33-1~bpo12+1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.34-0+deb12u1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.34-0+deb12u2 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.34-1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.35-1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.40-1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.40-1~bpo12+1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.46-1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.52-1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.52-1~deb12u1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.52-1~deb13u1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.52-2 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.54-1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.55-1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.55-1~deb12u1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.55-1~deb13u1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.6-1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.6-1+deb12u1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.6-1+deb12u2 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.60-1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.7-1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.8-1 | No fix listed |
| debian/tomcat10(Debian:12) | = 10.1.9-1 | No fix listed |
| debian/tomcat10(Debian:13) | All versions | No fix listed |
| debian/tomcat10(Debian:13) | = 10.1.40-1 | No fix listed |
| debian/tomcat10(Debian:13) | = 10.1.46-1 | No fix listed |
| debian/tomcat10(Debian:13) | = 10.1.52-1 | No fix listed |
| debian/tomcat10(Debian:13) | = 10.1.52-1~deb12u1 | No fix listed |
| debian/tomcat10(Debian:13) | = 10.1.52-1~deb13u1 | No fix listed |
| debian/tomcat10(Debian:13) | = 10.1.52-2 | No fix listed |
| debian/tomcat10(Debian:13) | = 10.1.54-1 | No fix listed |
| debian/tomcat10(Debian:13) | = 10.1.55-1 | No fix listed |
| debian/tomcat10(Debian:13) | = 10.1.55-1~deb12u1 | No fix listed |
| debian/tomcat10(Debian:13) | = 10.1.55-1~deb13u1 | No fix listed |
| debian/tomcat10(Debian:13) | = 10.1.60-1 | No fix listed |
| debian/tomcat10(Debian:14) | < 10.1.60-1 | 10.1.60-1 |
| debian/tomcat10(Debian:14) | = 10.1.40-1 | No fix listed |
| debian/tomcat10(Debian:14) | = 10.1.46-1 | No fix listed |
| debian/tomcat10(Debian:14) | = 10.1.52-1 | No fix listed |
| debian/tomcat10(Debian:14) | = 10.1.52-1~deb12u1 | No fix listed |
| debian/tomcat10(Debian:14) | = 10.1.52-1~deb13u1 | No fix listed |
| debian/tomcat10(Debian:14) | = 10.1.52-2 | No fix listed |
| debian/tomcat10(Debian:14) | = 10.1.54-1 | No fix listed |
| debian/tomcat10(Debian:14) | = 10.1.55-1 | No fix listed |
| debian/tomcat10(Debian:14) | = 10.1.55-1~deb12u1 | No fix listed |
| debian/tomcat10(Debian:14) | = 10.1.55-1~deb13u1 | No fix listed |
| debian/tomcat11(Debian:13) | All versions | No fix listed |
| debian/tomcat11(Debian:13) | = 11.0.11-1 | No fix listed |
| debian/tomcat11(Debian:13) | = 11.0.15-1 | No fix listed |
| debian/tomcat11(Debian:13) | = 11.0.15-1~deb13u1 | No fix listed |
| debian/tomcat11(Debian:13) | = 11.0.18-1 | No fix listed |
| debian/tomcat11(Debian:13) | = 11.0.21-1 | No fix listed |
| debian/tomcat11(Debian:13) | = 11.0.22-1 | No fix listed |
| debian/tomcat11(Debian:13) | = 11.0.22-1~deb13u1 | No fix listed |
| debian/tomcat11(Debian:13) | = 11.0.22-2 | No fix listed |
| debian/tomcat11(Debian:13) | = 11.0.24-1 | No fix listed |
| debian/tomcat11(Debian:13) | = 11.0.6-1 | No fix listed |
| debian/tomcat11(Debian:14) | All versions | No fix listed |
| debian/tomcat11(Debian:14) | = 11.0.11-1 | No fix listed |
| debian/tomcat11(Debian:14) | = 11.0.15-1 | No fix listed |
| debian/tomcat11(Debian:14) | = 11.0.15-1~deb13u1 | No fix listed |
| debian/tomcat11(Debian:14) | = 11.0.18-1 | No fix listed |
| debian/tomcat11(Debian:14) | = 11.0.21-1 | No fix listed |
| debian/tomcat11(Debian:14) | = 11.0.22-1 | No fix listed |
| debian/tomcat11(Debian:14) | = 11.0.22-1~deb13u1 | No fix listed |
| debian/tomcat11(Debian:14) | = 11.0.22-2 | No fix listed |
| debian/tomcat11(Debian:14) | = 11.0.24-1 | No fix listed |
| debian/tomcat11(Debian:14) | = 11.0.6-1 | No fix listed |
| debian/tomcat9(Debian:12) | < 9.0.70-2 | 9.0.70-2 |
| debian/tomcat9(Debian:13) | < 9.0.70-2 | 9.0.70-2 |
| debian/tomcat9(Debian:14) | < 9.0.70-2 | 9.0.70-2 |
| ubuntu/tomcat9(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/tomcat10(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/tomcat9(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/tomcat10(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/tomcat9(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/tomcat11(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/tomcat10(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/tomcat11(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/tomcat9(Ubuntu:26.10) | All versions | No fix listed |
References
- Red Hat CVE page vendor-advisory
- RHSA-2026:68257 patch vendor-advisory
- RHSA-2026:68258 patch vendor-advisory
- Red Hat Bugzilla 2539533 issue-tracking
- www.cve.org
- nvd.nist.gov
- lists.apache.org vendor-advisory
- www.openwall.com
- Debian Security Tracker CVE-2026-78437 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- bugs.debian.org issue-tracking