CVE-2026-68763
published 2026-08-25CVE-2026-68763: Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue…
PriorityP347high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.74%
54.3th percentile
Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | — | — |
| apache | tomcat | >= 10.1.0 < 10.1.58 | 10.1.58 |
| apache | tomcat | >= 11.0.0 < 11.0.25 | 11.0.25 |
| apache | tomcat | >= 8.5.59 < 9.0.121 | 9.0.121 |
| apache_software_foundation | apache_tomcat | 10.1.0-M1 – 10.1.57 | — |
| apache_software_foundation | apache_tomcat | 11.0.0-M1 – 11.0.24 | — |
| apache_software_foundation | apache_tomcat | 8.5.59 – 8.5.100 | — |
| apache_software_foundation | apache_tomcat | 9.0.39 – 9.0.120 | — |
| debian | tomcat10 | — | — |
| debian | tomcat11 | — | — |
| debian | tomcat9 | — | — |
| pki-deps_10.6 | pki-servlet-engine | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
org.apache.tomcat/tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak
vendor_redhat·2026-08-25·CVSS 7.5
CVE-2026-68763 [HIGH] CWE-770 org.apache.tomcat/tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak
org.apache.tomcat/tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak
Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
A flaw was found in Apache Tomcat. This vulnerability, an uncontrolled resource consumption issue, arises from an allocation leak in the HTTP/2 backlog tracking when a stream is
VulDB
Apache Tomcat up to 11.0.24/10.1.57/9.0.120/8.5.100 HTTP/2 Backlog Tracking allocation of resources (EUVD-2026-66190 / Nessus ID 345835)
vuldb·2026-09-15·CVSS 7.5
CVE-2026-68763 [HIGH] Apache Tomcat up to 11.0.24/10.1.57/9.0.120/8.5.100 HTTP/2 Backlog Tracking allocation of resources (EUVD-2026-66190 / Nessus ID 345835)
A vulnerability marked as problematic has been reported in Apache Tomcat up to 11.0.24/10.1.57/9.0.120/8.5.100. Affected by this issue is some unknown functionality of the component HTTP2 Backlog Tracking. Performing a manipulation results in allocation of resources.
This vulnerability is known as CVE-2026-68763. Remote exploitation of the attack is possible. No exploit is available.
It is suggested to upgrade the affected component.
GHSA
Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0-M1 throug
ghsa_unreviewed·2026-08-26
CVE-2026-68763 CWE-400 Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0-M1 throug
Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
No detection rules found.
No public exploits indexed.
2026-08-25
Published