HIGHFixed upstream

CVE-2026-78437

Apache Tomcat: HTTP/2 denial of service via malformed request

Technology

Apache Tomcat

CVSS Score

7.3 / 10.0

Affected Versions

11.0.19 to 11.0.25; 10.1.53 to 10.1.59; 9.0.116 to 9.0.121

Upstream Fix

11.0.26; 10.1.60; 9.0.122

Published

September 23, 2026

OSSeva Coverage

Fixed upstream

Description

Incomplete cleanup after a malformed HTTP/2 request could, depending on timing, cause a request from another user to fail. Made public on 23 September 2026 and rated Low by the Tomcat security team. Fixed in 11.0.26, 10.1.60 and 9.0.122.

Upstream record: NVD · CVE.org

Is your Apache Tomcat deployment affected?

If you're running 11.0.19 to 11.0.25; 10.1.53 to 10.1.59; 9.0.116 to 9.0.121, you need this patch. Book a discovery call to get covered.

Book a discovery call View Apache Tomcat coverage →

Get a quote

Running Apache Tomcat 11.0.19 to 11.0.25; 10.1.53 to 10.1.59; 9.0.116 to 9.0.121?

Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.

Prefer to talk or read more first?

Book a 15-minute call Apache Tomcat support