Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-78437— Apache Tomcat: HTTP/2 DoS via malformed request

Quick assessment

Affected

Apache Software Foundation Apache Tomcat

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Tomcat 中存在不完整的清理机制漏洞，攻击者通过构造恶意请求，有可能（取决于时间条件）导致另一个用户的请求失败。该漏洞影响以下版本的 Apache Tomcat：11.0.19 至 11.0.25、10.1.53 至 10.1.59，以及 9.0.116 至 9.0.121。建议用户升级至已修复此问题的版本：11.0.26、10.1.60 或 9.0.122。

AI Predicted 3.3 Difficulty: Moderate EPSS 0.51% · P44 Updated Sep 24, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 4

Vendor	Product	Version Range	Status
Apache Software Foundation	Apache Tomcat	`11.0.19≤ 11.0.25`	affected
		`10.1.53≤ 10.1.59`	affected
		`9.0.116≤ 9.0.121`	affected
		`≤ 8.5.100`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Apache Tomcat: HTTP/2 DoS via malformed request

Source: CVE Program / CVE List V5

Vulnerability Description

Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail. This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

清理环节不完整

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Apache Software Foundation	Apache Tomcat	11.0.19 ~ 11.0.25	-

II. Public POCs for CVE-2026-78437

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-78437

请登录查看更多情报信息。

Mailing List Discussions for CVE-2026-78437 (1)

🔗 [SECURITY] CVE-2026-78437 Apache Tomcat - HTTP/2 DoS via malformed request-Apache Mail Archives vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-78437

Same Patch Batch · Apache Software Foundation · 2026-09-23 · 25 CVEs total

CVE-2026-31377	7.5 HIGH	Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service
CVE-2026-86247		Apache Tomcat Native: Client certificate requirements can be down-graded
CVE-2026-82331		Apache BuildStream: tar source extraction escape
CVE-2026-86246		Apache Tomcat Native: Insecure OpenSSL options enabled
CVE-2026-86243		Apache Tomcat Native: DoS via TLS handshake
CVE-2026-87022		Apache Tomcat: WebSocket message smuggling with per-message-deflate
CVE-2026-86350		Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up
CVE-2026-86248		Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with
CVE-2026-79677		Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout
CVE-2026-78383		Apache Tomcat: AJP DoS via missing request body
CVE-2026-77791		Apache Tomcat: DoS via busy wait during WebSocket close
CVE-2026-77762		Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request
CVE-2026-77756		Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests
CVE-2026-76183		Apache Tomcat: Bypass of security constraints for WebSocket endpoints
CVE-2026-75973		Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured
CVE-2026-73581		Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate us
CVE-2026-94243		Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence
CVE-2026-94251		Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape
CVE-2026-91928		Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf prote
CVE-2026-96443		Apache Doris: JDBC driver URL validation bypass leads to remote code execution

Showing top 20 of 25 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Apache Tomcat

Same vendor: Apache Software Foundation

Same weakness: CWE-459