PT-2026-81889

CVE-2026-68763

·

Published

2026-08-20

·

Updated

2026-10-06

Description by

CVSS 3.1
9.8
Critical
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.39 through 9.0.120 Apache Tomcat versions 8.5.59 through 8.5.100
Description An uncontrolled resource consumption issue exists due to an allocation leak in the HTTP/2 backlog tracking that occurs when a stream is reset.
Recommendations Upgrade to version 11.0.25. Upgrade to version 10.1.58. Upgrade to version 9.0.121.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-400: Uncontrolled Resource Consumption
Related identifiers
CVE-2026-68763
BDU:2026-16150
BIT-TOMCAT-2026-68763
CLSA-2026-1788273808
CLSA-2026-1788353293
OESA-2026-3592
OPENSUSE-SU-2026:11759-1
OPENSUSE-SU-2026:11760-1
OPENSUSE-SU-2026:11761-1
OPENSUSE-SU-2026:21810-1
OPENSUSE-SU-2026:21811-1
OPENSUSE-SU-2026:21823-1
RHSA-2026:56039
SUSE-SU-2026:23690-1
SUSE-SU-2026:23691-1
SUSE-SU-2026:23700-1
SUSE-SU-2026:23710-1
SUSE-SU-2026:23711-1
SUSE-SU-2026:23720-1
SUSE-SU-2026:4114-1
SUSE-SU-2026:4119-1
SUSE-SU-2026:4126-1
SUSE-SU-2026:4203-1
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com