Apache Tomcat up to 9.0.121/10.1.59/11.0.25 sizeof() on a pointer type

Summaryinfo

A vulnerability was found in Apache Tomcat up to 9.0.121/10.1.59/11.0.25. It has been rated as problematic. This affects an unknown function. Performing a manipulation results in use of sizeof() on a pointer type. This vulnerability was named CVE-2026-78437. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic has been found in Apache Tomcat up to 9.0.121/10.1.59/11.0.25. This affects an unknown function. The manipulation with an unknown input leads to a use of sizeof() on a pointer type vulnerability. CWE is classifying the issue as CWE-467. The code calls sizeof() on a malloced pointer type, which always returns the wordsize/8. This can produce an unexpected result if the programmer intended to determine how much memory has been allocated. This is going to have an impact on availability. The summary by CVE is:

Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail. This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

The advisory is shared at lists.apache.org. This vulnerability is uniquely identified as CVE-2026-78437 since 08/24/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 349598 (Linux Distros Unpatched Vulnerability : CVE-2026-78437), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 9.0.122, 10.1.60 or 11.0.26 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (349598) and CERT Bund (WID-SEC-2026-3527). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Apache Tomcat

Productinfo

Type

• Application Server Software

Vendor

• Apache

Name

• Tomcat

Version

• 9.0.121
• 10.1.0
• 10.1.1
• 10.1.2
• 10.1.3
• 10.1.4
• 10.1.5
• 10.1.6
• 10.1.7
• 10.1.8
• 10.1.9
• 10.1.10
• 10.1.11
• 10.1.12
• 10.1.13
• 10.1.14
• 10.1.15
• 10.1.16
• 10.1.17
• 10.1.18
• 10.1.19
• 10.1.20
• 10.1.21
• 10.1.22
• 10.1.23
• 10.1.24
• 10.1.25
• 10.1.26
• 10.1.27
• 10.1.28
• 10.1.29
• 10.1.30
• 10.1.31
• 10.1.32
• 10.1.33
• 10.1.34
• 10.1.35
• 10.1.36
• 10.1.37
• 10.1.38
• 10.1.39
• 10.1.40
• 10.1.41
• 10.1.42
• 10.1.43
• 10.1.44
• 10.1.45
• 10.1.46
• 10.1.47
• 10.1.48
• 10.1.49
• 10.1.50
• 10.1.51
• 10.1.52
• 10.1.53
• 10.1.54
• 10.1.55
• 10.1.56
• 10.1.57
• 10.1.58
• 10.1.59
• 11.0.0
• 11.0.1
• 11.0.2
• 11.0.3
• 11.0.4
• 11.0.5
• 11.0.6
• 11.0.7
• 11.0.8
• 11.0.9
• 11.0.10
• 11.0.11
• 11.0.12
• 11.0.13
• 11.0.14
• 11.0.15
• 11.0.16
• 11.0.17
• 11.0.18
• 11.0.19
• 11.0.20
• 11.0.21
• 11.0.22
• 11.0.23
• 11.0.24
• 11.0.25

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion