HIGHFixed upstream

CVE-2026-77762

Apache Tomcat: stale HPACK emitter injects trailers into another HTTP/2 request

Technology

Apache Tomcat

CVSS Score

8.1 / 10.0

Affected Versions

11.0.0-M1 to 11.0.25; 10.1.0-M1 to 10.1.59; 9.0.39 to 9.0.121; end of life but known affected: 8.5.59 to 8.5.100

Upstream Fix

11.0.26; 10.1.60; 9.0.122

Published

September 23, 2026

OSSeva Coverage

Fixed upstream

Description

A race condition allowed an attacker to inject trailer fields into another HTTP/2 request handled by a recycled, pooled request object. Made public on 23 September 2026 and rated Low by the Tomcat security team. Fixed in 11.0.26, 10.1.60 and 9.0.122.

Upstream record: NVD · CVE.org

Is your Apache Tomcat deployment affected?

If you're running 11.0.0-M1 to 11.0.25; 10.1.0-M1 to 10.1.59; 9.0.39 to 9.0.121; end of life but known affected: 8.5.59 to 8.5.100, you need this patch. Book a discovery call to get covered.

Book a discovery call View Apache Tomcat coverage →

Get a quote

Running Apache Tomcat 11.0.0-M1 to 11.0.25; 10.1.0-M1 to 10.1.59; 9.0.39 to 9.0.121; end of life but known affected: 8.5.59 to 8.5.100?

Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.

Prefer to talk or read more first?

Book a 15-minute call Apache Tomcat support