CVE-2026-78437 in Tomcat
Summary
by MITRE • 09/23/2026
Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail.
This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121.
Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability described involves an incomplete cleanup mechanism within Apache Tomcat that can lead to a denial of service condition for other users under specific timing conditions. This flaw is present in several recent versions of the server software, specifically affecting releases from 11.0.19 through 11.0.25, 10.1.53 through 10.1.59, and 9.0.116 through 9.0.121. The core issue stems from how the application server handles resource deallocation when processing malformed or abnormal HTTP requests. When a request is deemed invalid or encounters an error during parsing or execution, Tomcat fails to properly release certain internal resources associated with that connection. This oversight creates a state where subsequent legitimate requests may fail because they attempt to utilize resources that are still locked or held by the previous incomplete transaction.
From a technical perspective, this behavior aligns with CWE-409, which describes improper cleanup of semantically important information after extraction. In the context of web servers like Tomcat, this often manifests as resource leaks such as unclosed sockets, unreleased thread pool entries, or improperly reset request objects. The vulnerability is particularly insidious because it relies on timing and race conditions. An attacker does not need to exploit a complex code execution flaw but rather needs to send malformed requests at precise intervals to trigger the incomplete cleanup state. Once this state is achieved, any subsequent user attempting to access the server may experience failures in their request processing, effectively causing a denial of service for those users even though the system itself remains operational and responsive to other types of traffic.
The operational impact of this vulnerability is primarily focused on availability rather than confidentiality or integrity. Legitimate users interacting with applications hosted on Apache Tomcat will encounter errors such as HTTP 500 Internal Server Error or connection timeouts when their requests collide with the lingering state caused by the malformed request. This can lead to significant service disruption, especially in high-traffic environments where multiple concurrent connections are common. The unpredictability of the failure makes it difficult for system administrators to diagnose using standard monitoring tools, as the issue is transient and dependent on specific concurrency patterns.
To mitigate this risk, organizations running affected versions of Apache Tomcat should upgrade immediately to version 11.0.26, 10.1.60, or 9.0.122, depending on their current deployment tier. These updated releases contain the necessary patches to ensure that all resources are properly released regardless of whether a request completes successfully or fails due to malformed input. In addition to upgrading, administrators should implement robust input validation and rate limiting at the network perimeter using web application firewalls or reverse proxies. This can help prevent malformed requests from reaching the Tomcat instance in the first place, thereby reducing the likelihood of triggering the vulnerability. Regular security audits and adherence to secure coding practices further enhance resilience against such concurrency-related flaws.