p PatchFirst

CVE-2026-78437

CVE-2026-78437 · Apache Tomcat: HTTP/2 DoS via malformed request

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail. This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

CVSS 7.3 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • apache tomcat

    Versions
    • ≥ 11.0.19, ≤ 11.0.25: Affected (semver)
    • ≥ 10.1.53, ≤ 10.1.59: Affected (semver)
    • ≥ 9.0.116, ≤ 9.0.121: Affected (semver)
    • ≥ 0, ≤ 8.5.100: Not affected (semver)

    No fix published

  • tomcat10 Debian:12

    Versions
    • 10.1.10-1
    • 10.1.13-1
    • 10.1.14-1
    • 10.1.15-1
    • 10.1.16-1
    • 10.1.20-1
    • 10.1.23-1
    • 10.1.25-1
    • 10.1.25-1~bpo12+1
    • 10.1.25-2
    • 10.1.30-1
    • 10.1.30-1~bpo12+1
    • 10.1.31-1
    • 10.1.33-1
    • 10.1.33-1~bpo12+1
    • 10.1.34-0+deb12u1
    • 10.1.34-0+deb12u2
    • 10.1.34-1
    • 10.1.35-1
    • 10.1.40-1
    • 10.1.40-1~bpo12+1
    • 10.1.46-1
    • 10.1.52-1
    • 10.1.52-1~deb12u1
    • 10.1.52-1~deb13u1
    • 10.1.52-2
    • 10.1.54-1
    • 10.1.55-1
    • 10.1.55-1~deb12u1
    • 10.1.55-1~deb13u1
    • 10.1.6-1
    • 10.1.6-1+deb12u1
    • 10.1.6-1+deb12u2
    • 10.1.60-1
    • 10.1.7-1
    • 10.1.8-1
    • 10.1.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat10 Debian:13

    Versions
    • 10.1.40-1
    • 10.1.46-1
    • 10.1.52-1
    • 10.1.52-1~deb12u1
    • 10.1.52-1~deb13u1
    • 10.1.52-2
    • 10.1.54-1
    • 10.1.55-1
    • 10.1.55-1~deb12u1
    • 10.1.55-1~deb13u1
    • 10.1.60-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat10 Debian:14

    Versions
    • 10.1.40-1
    • 10.1.46-1
    • 10.1.52-1
    • 10.1.52-1~deb12u1
    • 10.1.52-1~deb13u1
    • 10.1.52-2
    • 10.1.54-1
    • 10.1.55-1
    • 10.1.55-1~deb12u1
    • 10.1.55-1~deb13u1
    Affected ranges
    • ECOSYSTEM: < 10.1.60-1

    Update to 10.1.60-1

  • tomcat11 Debian:13

    Versions
    • 11.0.11-1
    • 11.0.15-1
    • 11.0.15-1~deb13u1
    • 11.0.18-1
    • 11.0.21-1
    • 11.0.22-1
    • 11.0.22-1~deb13u1
    • 11.0.22-2
    • 11.0.24-1
    • 11.0.6-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat11 Debian:14

    Versions
    • 11.0.11-1
    • 11.0.15-1
    • 11.0.15-1~deb13u1
    • 11.0.18-1
    • 11.0.21-1
    • 11.0.22-1
    • 11.0.22-1~deb13u1
    • 11.0.22-2
    • 11.0.24-1
    • 11.0.6-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat9 Debian:12

    Affected ranges
    • ECOSYSTEM: < 9.0.70-2

    Update to 9.0.70-2

  • tomcat9 Debian:13

    Affected ranges
    • ECOSYSTEM: < 9.0.70-2

    Update to 9.0.70-2

  • tomcat9 Debian:14

    Affected ranges
    • ECOSYSTEM: < 9.0.70-2

    Update to 9.0.70-2

  • tomcat6 Ubuntu:Pro:14.04:LTS

    Versions
    • 6.0.37-1
    • 6.0.39-1
    • 6.0.39-1ubuntu0.1
    • 6.0.39-1ubuntu0.1+esm1
    • 6.0.39-1ubuntu0.1+esm2
    • 6.0.39-1ubuntu0.1+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat7 Ubuntu:Pro:14.04:LTS

    Versions
    • 7.0.42-1
    • 7.0.47-1
    • 7.0.50-1
    • 7.0.52-1
    • 7.0.52-1ubuntu0.1
    • 7.0.52-1ubuntu0.3
    • 7.0.52-1ubuntu0.6
    • 7.0.52-1ubuntu0.7
    • 7.0.52-1ubuntu0.8
    • 7.0.52-1ubuntu0.9
    • 7.0.52-1ubuntu0.10
    • 7.0.52-1ubuntu0.11
    • 7.0.52-1ubuntu0.13
    • 7.0.52-1ubuntu0.14
    • 7.0.52-1ubuntu0.15
    • 7.0.52-1ubuntu0.16
    • 7.0.52-1ubuntu0.16+esm1
    • 7.0.52-1ubuntu0.16+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat8 Ubuntu:Pro:16.04:LTS

    Versions
    • 8.0.26-1
    • 8.0.28-1
    • 8.0.30-1
    • 8.0.32-1
    • 8.0.32-1ubuntu1
    • 8.0.32-1ubuntu1.1
    • 8.0.32-1ubuntu1.2
    • 8.0.32-1ubuntu1.3
    • 8.0.32-1ubuntu1.4
    • 8.0.32-1ubuntu1.5
    • 8.0.32-1ubuntu1.6
    • 8.0.32-1ubuntu1.7
    • 8.0.32-1ubuntu1.8
    • 8.0.32-1ubuntu1.9
    • 8.0.32-1ubuntu1.10
    • 8.0.32-1ubuntu1.11
    • 8.0.32-1ubuntu1.13
    • 8.0.32-1ubuntu1.13+esm1
    • 8.0.32-1ubuntu1.13+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat7 Ubuntu:Pro:16.04:LTS

    Versions
    • 7.0.64-1
    • 7.0.68-1
    • 7.0.68-1ubuntu0.1
    • 7.0.68-1ubuntu0.3
    • 7.0.68-1ubuntu0.4
    • 7.0.68-1ubuntu0.4+esm1
    • 7.0.68-1ubuntu0.4+esm2
    • 7.0.68-1ubuntu0.4+esm3
    • 7.0.68-1ubuntu0.4+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat8 Ubuntu:Pro:18.04:LTS

    Versions
    • 8.5.21-1ubuntu1
    • 8.5.29-1
    • 8.5.30-1
    • 8.5.30-1ubuntu1
    • 8.5.30-1ubuntu1.2
    • 8.5.30-1ubuntu1.3
    • 8.5.30-1ubuntu1.4
    • 8.5.39-1ubuntu1~18.04.1
    • 8.5.39-1ubuntu1~18.04.2
    • 8.5.39-1ubuntu1~18.04.3
    • 8.5.39-1ubuntu1~18.04.3+esm1
    • 8.5.39-1ubuntu1~18.04.3+esm2
    • 8.5.39-1ubuntu1~18.04.3+esm3
    • 8.5.39-1ubuntu1~18.04.3+esm4
    • 8.5.39-1ubuntu1~18.04.3+esm5
    • 8.5.39-1ubuntu1~18.04.3+esm6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat9 Ubuntu:Pro:18.04:LTS

    Versions
    • 9.0.16-3~18.04.1
    • 9.0.16-3ubuntu0.18.04.1
    • 9.0.16-3ubuntu0.18.04.2
    • 9.0.16-3ubuntu0.18.04.2+esm1
    • 9.0.16-3ubuntu0.18.04.2+esm2
    • 9.0.16-3ubuntu0.18.04.2+esm3
    • 9.0.16-3ubuntu0.18.04.2+esm4
    • 9.0.16-3ubuntu0.18.04.2+esm5
    • 9.0.16-3ubuntu0.18.04.2+esm6
    • 9.0.16-3ubuntu0.18.04.2+esm7
    • 9.0.16-3ubuntu0.18.04.2+esm8
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat9 Ubuntu:Pro:20.04:LTS

    Versions
    • 9.0.24-1
    • 9.0.27-1
    • 9.0.31-1
    • 9.0.31-1ubuntu0.1
    • 9.0.31-1ubuntu0.2
    • 9.0.31-1ubuntu0.3
    • 9.0.31-1ubuntu0.4
    • 9.0.31-1ubuntu0.5
    • 9.0.31-1ubuntu0.6
    • 9.0.31-1ubuntu0.7
    • 9.0.31-1ubuntu0.8
    • 9.0.31-1ubuntu0.9
    • 9.0.31-1ubuntu0.9+esm1
    • 9.0.31-1ubuntu0.9+esm2
    • 9.0.31-1ubuntu0.9+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat9 Ubuntu:Pro:22.04:LTS

    Versions
    • 9.0.43-3
    • 9.0.54-1
    • 9.0.55-1
    • 9.0.58-1
    • 9.0.58-1ubuntu0.1
    • 9.0.58-1ubuntu0.1+esm1
    • 9.0.58-1ubuntu0.1+esm2
    • 9.0.58-1ubuntu0.1+esm3
    • 9.0.58-1ubuntu0.1+esm4
    • 9.0.58-1ubuntu0.2
    • 9.0.58-1ubuntu0.2+esm1
    • 9.0.58-1ubuntu0.2+esm2
    • 9.0.58-1ubuntu0.2+esm3
    • 9.0.58-1ubuntu0.2+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat10 Ubuntu:24.04:LTS

    Versions
    • 10.1.10-1
    • 10.1.14-1
    • 10.1.15-1
    • 10.1.16-1
    • 10.1.16-1ubuntu0.1~esm1
    • 10.1.16-1ubuntu0.1~esm2
    • 10.1.16-1ubuntu0.1~esm3
    • 10.1.16-1ubuntu0.1~esm4
    • 10.1.55-1ubuntu2~24.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat9 Ubuntu:24.04:LTS

    Versions
    • 9.0.70-1ubuntu1
    • 9.0.70-2
    • 9.0.70-2ubuntu0.1
    • 9.0.70-2ubuntu0.1+esm1
    • 9.0.70-2ubuntu0.1+esm2
    • 9.0.70-2ubuntu0.1+esm3
    • 9.0.118-1~24.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat10 Ubuntu:26.10

    Versions
    • 10.1.40-1ubuntu1
    • 10.1.54-1
    • 10.1.54-1ubuntu1
    • 10.1.54-1ubuntu2
    • 10.1.55-1ubuntu1
    • 10.1.55-1ubuntu2
    • 10.1.57~us1-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat11 Ubuntu:26.10

    Versions
    • 11.0.18-1
    • 11.0.22-2
    • 11.0.22-2ubuntu1
    • 11.0.22-2ubuntu2
    • 11.0.24-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat9 Ubuntu:26.10

    Versions
    • 9.0.115-1
    • 9.0.115-1ubuntu1
    • 9.0.118-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat10 Ubuntu:26.04:LTS

    Versions
    • 10.1.40-1ubuntu1
    • 10.1.40-1ubuntu1.26.04.1
    • 10.1.55-1ubuntu2~26.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat9 Ubuntu:26.04:LTS

    Versions
    • 9.0.95-1ubuntu1
    • 9.0.111-1
    • 9.0.115-1
    • 9.0.115-1ubuntu0.1
    • 9.0.118-1~26.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →