Skip to content
Fencer Vulns
high 8.1

CVE-2026-77762 json

Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request

published 2026-09-23 47 d ago modified 2026-10-01 39 d ago also BIT-tomcat-2026-77762 , EUVD-2026-85227

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 40%
public exploits
0
none known

Summary

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.39 through 9.0.121.

The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fix the issue.

Patch / fix

  • bitnami tomcat 9.0.122, 10.1.60, 11.0.26
  • tomcat9 Debian 14, Debian 13, Debian 12 9.0.70-2
  • tomcat10 Debian 14 10.1.60-1

debian advisories DEBIAN-CVE-2026-77762

  • tomcat10 hummingbird 1 10.1.60-0.1.hum1
  • tomcat10-lib hummingbird 1 10.1.60-0.1.hum1
  • tomcat10-common hummingbird 1 10.1.60-0.1.hum1
  • tomcat10-webapps hummingbird 1 10.1.60-0.1.hum1
  • tomcat10-el-5.0-api hummingbird 1 10.1.60-0.1.hum1
  • tomcat10-docs-webapp hummingbird 1 10.1.60-0.1.hum1
  • tomcat10-jsp-3.1-api hummingbird 1 10.1.60-0.1.hum1
  • tomcat10-admin-webapps hummingbird 1 10.1.60-0.1.hum1

red hat advisories RHSA-2026:68257RHSA-2026:68258

  • tomcat10 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES 15 SP6-LTSS +4 more 10.1.60-150200.5.82.2
  • tomcat SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 9.0.122-150200.123.2
  • libtcnative-1-0 SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 1.3.9-150200.6.11.2
  • tomcat11 SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Web and Scripting 15 SP7 11.0.26-150600.13.36.2
  • libtcnative-1-0 SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Web and Scripting 15 SP7 +1 more 1.3.9-150600.16.9.2
  • tomcat11 SLES for SAP applications 16.0, SLES 16.0 11.0.26-160000.1.1
  • tomcat SLES for SAP applications 16.0, SLES 16.0 9.0.122-160000.1.1
  • tomcat10 SLES for SAP applications 16.0, SLES 16.0 10.1.60-160000.1.1

suse advisories SUSE-SU-2026:4927-1SUSE-SU-2026:4546-1SUSE-SU-2026:4544-1SUSE-SU-2026:23985-1

  • tomcat11 openSUSE Leap 16.0 11.0.26-160000.1.1
  • tomcat openSUSE Leap 16.0 9.0.122-160000.1.1
  • tomcat10 openSUSE Leap 16.0 10.1.60-160000.1.1
  • libtcnative-1-0 openSUSE Leap 16.0 1.3.9-160000.1.1
  • libtcnative-2-0 openSUSE Leap 16.0 2.0.16-160000.1.1
  • tomcat openSUSE Tumbleweed 9.0.122-1.1
  • tomcat10 openSUSE Tumbleweed 10.1.60-1.1
  • tomcat11 openSUSE Tumbleweed 11.0.26-1.1

opensuse advisories openSUSE-SU-2026:21984-1openSUSE-SU-2026:11906-1openSUSE-SU-2026:11907-1openSUSE-SU-2026:11908-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-77762 updated cvss 6.5

tomcat: Apache Tomcat: Race condition allows HTTP/2 request manipulation

  • Red Hat Enterprise Linux 6 tomcat6, tomcat6-lib, tomcat6-log4j, tomcat6-javadoc, tomcat6-webapps, tomcat6-el-2.1-api, +4 more Red Hat Enterprise Linux 7 tomcat, tomcat-lib, tomcat-jsvc, tomcat-javadoc, tomcat-webapps, tomcat-el-2.2-api, +4 more
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 tomcat, tomcat-lib, tomcat-webapps, tomcat-el-3.0-api, tomcat-docs-webapp, tomcat-jsp-2.3-api, +2 more Red Hat Enterprise Linux 9 tomcat, tomcat-lib, tomcat-webapps, tomcat-el-3.0-api, pki-servlet-engine, tomcat-docs-webapp, +4 more Red Hat Enterprise Linux 10 tomcat, tomcat9 Red Hat JBoss Web Server 5 jws5-tomcat, jws5-tomcat-lib, jws5-tomcat-jsvc, jws5-tomcat-javadoc, jws5-tomcat-selinux, jws5-tomcat-webapps, +7 more
    affected: no fix available “Fix deferred”
  • Red Hat JBoss Web Server 6 jws6-tomcat, jws6-tomcat-lib, jws6-tomcat-javadoc, jws6-tomcat-selinux, jws6-tomcat-webapps, jws6-tomcat-el-5.0-api, +4 more Red Hat JBoss Web Server 7 jws7-tomcat
    affected: no fix available
  • Red Hat Hardened Images tomcat10 10.1.60-0.1.hum1, tomcat11 11.0.26-0.1.hum1, tomcat10-lib 10.1.60-0.1.hum1, tomcat11-lib 11.0.26-0.1.hum1, tomcat10-common 10.1.60-0.1.hum1, tomcat11-common 11.0.26-0.1.hum1, +14 more
    fixed: vendor fix RHSA-2026:68257
  • Red Hat Enterprise Linux 8 pki-servlet-engine, pki-servlet-4.0-api
    not affected: vulnerable code not present
  • Red Hat Hardened Images hi/tomcat
    not affected: component not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
46 d ago

Exploit prediction

0.46% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami tomcat
>=8.56.59, <9.0.122
>=10.1.0, <10.1.60
>=11.0.0, <11.0.26
9.0.122
10.1.60
11.0.26

Affected products

  • Apache Software Foundation Apache Tomcat

Classification

Weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.