Skip to main content

Apache Tomcat CVE-2026-68763

| EUVDEUVD-2026-66190 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-08-25 security@apache.org GHSA-82jr-6mfr-9vq5
Denial Of Service Apache Red Hat Tomcat Suse
7.5
CVSS 3.1 · Vendor: apache
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Connect to HTTP/2-enabled Tomcat HTTPS endpoint
  2. Delivery
    Open multiple HTTP/2 streams
  3. Exploit
    Send RST_STREAM frames to reset each stream
  4. Install
    Trigger allocation leak in backlog tracking per reset
  5. C2
    Accumulate unbounded heap consumption
  6. Execute
    Exhaust JVM memory
  7. Impact
    Tomcat denies service to legitimate clients

Vulnerability Assessment

Weakness
CWE
CWE-400
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires that HTTP/2 is explicitly enabled on the target Tomcat connector via the UpgradeProtocol element (class='org.apache.coyote.http2.Http2Protocol') in server.xml - this is not enabled in all default Tomcat configurations and typically requires TLS to be configured as a prerequisite. The attack requires only network-level access to the HTTP/2 port and no authentication (PR:N per CVSS vector). The vulnerability is exclusively a Denial of Service; no confidentiality or integrity impact is possible. HTTP/1.1 and AJP connectors are not affected, limiting exploitation to deployments that have intentionally enabled HTTP/2. EOL 8.5.x deployments share the same condition but will receive no patch.
Impact

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a maximally accessible network-exploitable DoS - no authentication, no complexity, no user interaction required - yielding a 7.5 HIGH score. Despite this, the EPSS score of 0.22% at the 13th percentile indicates very low current exploitation probability in the wild, well below what is typical for weaponized network-reachable DoS vulnerabilities against major server software. There is no CISA KEV listing and no reported POC code. The practical attack surface is partially constrained by the requirement that HTTP/2 must be explicitly enabled on the Tomcat connector, which is not the default in all deployment configurations. Taken together, this presents a real but not immediately critical priority: organizations with HTTP/2 exposed on internet-facing Tomcat instances should patch promptly, while internal deployments or those without HTTP/2 enabled face lower urgency. No conflicting signal between CVSS and EPSS is present - CVSS reflects theoretical worst-case exposure while EPSS reflects observed real-world attacker activity, which remains low.
Exploit ScenarioDerived

An unauthenticated remote attacker targets an internet-exposed Apache Tomcat server with HTTP/2 enabled on its HTTPS connector. The attacker uses a standard HTTP/2 client to rapidly open and immediately reset a high volume of streams via RST_STREAM frames, each triggering an unreclaimed memory allocation in the server's backlog tracker. Over seconds to minutes, JVM heap is exhausted, causing Tomcat to throw OutOfMemoryErrors and become unresponsive to legitimate traffic. No public exploit code has been identified at time of analysis, though the technique requires only basic HTTP/2 client capability.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 26, 2026

Uncontrolled resource consumption in Apache Tomcat's HTTP/2 implementation allows remote unauthenticated attackers to exhaust server memory by repeatedly opening and resetting HTTP/2 streams, exploiting an allocation leak in the backlog tracking mechanism that fails to release memory on stream reset. Affected branches span Tomcat 9.0.39-9.0.120, 10.1.0-M1-10.1.57, and 11.0.0-M1-11.0.24, with EOL branch 8.5.59-8.5.100 also confirmed vulnerable but unpatchable. No public exploit has been identified at time of analysis; EPSS stands at a low 0.22%, but the unauthenticated network vector and high availability impact make this operationally significant for any HTTP/2-enabled Tomcat deployment.

RemediationAI

The Apache Software Foundation has released patches in versions 11.0.25, 10.1.58, and 9.0.121, each of which resolves the allocation leak in HTTP/2 backlog tracking. Users should upgrade to the appropriate patched release for their branch as detailed at https://lists.apache.org/thread/tv51ty39ppv41v04hdtkp9dp7tg02nzl. Operators on the EOL 8.5.x branch have no vendor patch available and should migrate to a supported branch immediately. If an immediate upgrade is not feasible, disabling HTTP/2 on the Tomcat connector by removing or commenting out the UpgradeProtocol element (class='org.apache.coyote.http2.Http2Protocol') in server.xml eliminates the vulnerable code path entirely, at the cost of HTTP/2 performance benefits such as stream multiplexing and header compression. Alternatively, rate-limiting HTTP/2 stream resets at a fronting reverse proxy or load balancer (e.g., nginx stream reset limits or HAProxy connection throttling) can constrain the impact of exploitation without requiring an application-level change, though this does not eliminate the underlying leak.

Affected VersionsENISA

Apache Tomcat 10.1.0-M1 ≤10.1.57
Apache Tomcat 11.0.0-M1 ≤11.0.24
Apache Tomcat 8.5.59 ≤8.5.100
Apache Tomcat 9.0.39 ≤9.0.120

Affected Packages

euvd apache_tomcat no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Apache Tomcat's HTTP/2 implementation (org.apache.coyote.http2) maintains backlog tracking structures to manage the lifecycle of multiplexed HTTP/2 streams. The HTTP/2 protocol permits clients to reset in-flight streams at any time via RST_STREAM frames, at which point the server should release all associated resources. A CWE-400 (Uncontrolled Resource Consumption) flaw exists in this backlog accounting path: memory allocated to track reset streams is not reclaimed, causing heap consumption to grow unboundedly proportional to the rate of stream resets. The vulnerability is architectural to the HTTP/2 connector (UpgradeProtocol) and does not affect HTTP/1.1 or AJP connectors. Affected CPE entries span all actively maintained and EOL Tomcat branches with HTTP/2 support introduced in 8.5.x and formalized through the 9.x, 10.1.x, and 11.0.x lines.

Know when Tomcat gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apache) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Network-reachable DoS requiring no authentication or interaction; AC:L because sending RST_STREAM is a standard HTTP/2 operation with no special preconditions beyond connectivity.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
CVSS changed
Aug 26, 2026 - 19:23 NVD
7.5 (HIGH)
CVE Published
Aug 25, 2026 - 22:17 cve.org
HIGH 7.5
CVE Published
Aug 25, 2026 - 22:17 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120.

The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

Executive ViewAI

Why It Matters

Apache Tomcat HTTP/2 implementations in versions 9.0, 10.1, and 11.0 are vulnerable to remote, unauthenticated denial-of-service attacks that exhaust server memory and disrupt availability. With no vendor patch currently available, organizations must implement immediate defensive controls to protect production deployments. This affects any organization running affected Tomcat versions, requiring swift remediation to prevent attackers from disrupting critical application availability.

Business Impact: High
Compensating Controls

Disable HTTP/2 protocol if business requirements permit; implement connection-rate limiting and stream-reset rate throttling at firewall or load balancer tier; configure automated memory alerts and instance restart policies; restrict Tomcat access through network segmentation; establish real-time monitoring for abnormal memory consumption patterns.

Threat Intelligence Overview

EPSS Score
0.2%
Top 87% exploitable
Prevalence
High
widely deployed Java application server across enterprise environments globally
Social Media
1
Sightings
Data Quality
6 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Tomcat

View all
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2020-1938 CRITICAL POC
9.8 Feb 24

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
CVE-2023-47246 CRITICAL POC
9.8 Nov 10

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a f
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2017-12615 HIGH POC
8.1 Sep 19

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this

CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-0050 HIGH POC
7.5 Apr 01

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products,
CVE-2020-13935 HIGH POC
7.5 Jul 14

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to
CVE-2018-11784 MEDIUM POC
4.3 Oct 04

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a r
CVE-2022-29885 HIGH POC
7.5 May 12

The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78

CVE-2017-12616 HIGH
7.5 Sep 19

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or

CVE-2020-9484 HIGH POC
7.0 May 20

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2021-21341 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 12 SP5-LTSS Fixed
SUSE Linux Enterprise Server 15 SP5-LTSS Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-68763 ADVISORY https://seclists.org/oss-sec/2026/q3/587 ADVISORY https://vuldb.com/vuln/395386 REF http://www.openwall.com/lists/oss-security/2026/08/26/9 REF https://lists.apache.org/thread/tv51ty39ppv41v04hdtkp9dp7tg02nzl

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy