8.1

CVE-2026-77762

Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.39 through 9.0.121.



The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected.




Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fix the issue.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerApache Software Foundation
≫
Produkt Apache Tomcat
Default Statusunaffected
Version <= 11.0.25
Version 11.0.0-M1
Status affected
Version <= 10.1.59
Version 10.1.0-M1
Status affected
Version <= 9.0.121
Version 9.0.39
Status affected
Version <= 8.5.100
Version 8.5.59
Status affected
Version <= 7.0.109
Version 0
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.36% 0.271
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 8.1 2.2 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

https://lists.apache.org/thread/y5r9fvjo7ol24mkoyoc0st8bqrfyqcyn
http://www.openwall.com/lists/oss-security/2026/09/23/23