HIGHFixed upstream

CVE-2026-68763

Apache Tomcat: HTTP/2 denial of service via allocation leak on stream reset

Technology

Apache Tomcat

CVSS Score

7.5 / 10.0

Affected Versions

11.0.0-M1 to 11.0.24; 10.1.0-M1 to 10.1.57; 9.0.39 to 9.0.120; end of life but known affected: 8.5.59 to 8.5.100

Upstream Fix

11.0.25; 10.1.59; 9.0.121

Published

August 25, 2026

OSSeva Coverage

Fixed upstream

Description

An allocation leak in HTTP/2 backlog tracking when a stream was reset could be used to trigger a denial of service. Made public on 25 August 2026 and rated Important by the Tomcat security team. Fixed in 11.0.25, 10.1.59 and 9.0.121.

Upstream record: NVD · CVE.org

Is your Apache Tomcat deployment affected?

If you're running 11.0.0-M1 to 11.0.24; 10.1.0-M1 to 10.1.57; 9.0.39 to 9.0.120; end of life but known affected: 8.5.59 to 8.5.100, you need this patch. Book a discovery call to get covered.

Book a discovery call View Apache Tomcat coverage →

Get a quote

Running Apache Tomcat 11.0.0-M1 to 11.0.24; 10.1.0-M1 to 10.1.57; 9.0.39 to 9.0.120; end of life but known affected: 8.5.59 to 8.5.100?

Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.

Prefer to talk or read more first?

Book a 15-minute call Apache Tomcat support