PT-2026-97285 · Apache · Apache Tomcat

CVE-2026-77762

·

Published

2026-09-15

·

Updated

2026-10-01

CVSS v3.1

8.1

High

VectorAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.25 Apache Tomcat versions 10.1.0-M1 through 10.1.59 Apache Tomcat versions 9.0.39 through 9.0.121 Apache Tomcat versions 8.5.59 through 8.5.100
Description A race condition occurs due to improper synchronization when using shared resources during concurrent execution. This allows an attacker to inject trailer fields into another HTTP/2 request.
Recommendations Upgrade to version 11.0.26 Upgrade to version 10.1.60 Upgrade to version 9.0.122

Fix

DoS

Race Condition

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-362

Related Identifiers

BIT-TOMCAT-2026-77762
CVE-2026-77762
OPENSUSE-SU-2026:11906-1
OPENSUSE-SU-2026:11907-1
OPENSUSE-SU-2026:11908-1
OPENSUSE-SU-2026:21984-1
SUSE-SU-2026:23985-1

Affected Products

Apache Tomcat