CVE-2026-77762
published 2026-09-23CVE-2026-77762: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer…
PriorityP352high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
0.36%
28.7th percentile
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.39 through 9.0.121.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fix the issue.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | — | — |
| apache_software_foundation | apache_tomcat | 10.1.0-M1 – 10.1.59 | — |
| apache_software_foundation | apache_tomcat | 11.0.0-M1 – 11.0.25 | — |
| apache_software_foundation | apache_tomcat | 8.5.59 – 8.5.100 | — |
| apache_software_foundation | apache_tomcat | 9.0.39 – 9.0.121 | — |
| debian | tomcat10 | — | — |
| debian | tomcat11 | — | — |
| debian | tomcat9 | — | — |
| pki-deps_10.6 | pki-servlet-engine | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
tomcat: Apache Tomcat: Race condition allows HTTP/2 request manipulation
vendor_redhat·2026-09-23·CVSS 8.1
CVE-2026-77762 [HIGH] CWE-821 tomcat: Apache Tomcat: Race condition allows HTTP/2 request manipulation
tomcat: Apache Tomcat: Race condition allows HTTP/2 request manipulation
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.39 through 9.0.121.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fix the issue.
A flaw was found in Apache Tomcat. This vulnerability, caused by a race condition during concurrent execution, allows an attacker to injec
VulDB
Apache Tomcat up to 11.0.25/10.1.59/9.0.121 HTTP/2 race condition (WID-SEC-2026-3527)
vuldb·2026-09-24·CVSS 8.1
CVE-2026-77762 [HIGH] Apache Tomcat up to 11.0.25/10.1.59/9.0.121 HTTP/2 race condition (WID-SEC-2026-3527)
A vulnerability categorized as critical has been discovered in Apache Tomcat up to 11.0.25/10.1.59/9.0.121. The affected element is an unknown function of the component HTTP2. Such manipulation leads to race condition.
This vulnerability is referenced as CVE-2026-77762. It is possible to launch the attack remotely. No exploit is available.
It is advisable to upgrade the affected component.
GHSA
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request.
ghsa_unreviewed·2026-09-23
CVE-2026-77762 CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request.
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.39 through 9.0.121.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fix the issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-73581 CVE-2026-75973 CVE-2026-76183 CVE-2026-77756 CVE-2026-77762 CVE-2026-77791 CVE-2026-78383 CVE-2026-78437 CVE-2026-79677 CVE-2026-86248 CVE-2026-86350 CVE-2026-87022 tomcat: various flaw
bugzilla·2026-09-29·CVSS 9.8
CVE-2026-73581 [CRITICAL] CVE-2026-73581 CVE-2026-75973 CVE-2026-76183 CVE-2026-77756 CVE-2026-77762 CVE-2026-77791 CVE-2026-78383 CVE-2026-78437 CVE-2026-79677 CVE-2026-86248 CVE-2026-86350 CVE-2026-87022 tomcat: various flaw
CVE-2026-73581 CVE-2026-75973 CVE-2026-76183 CVE-2026-77756 CVE-2026-77762 CVE-2026-77791 CVE-2026-78383 CVE-2026-78437 CVE-2026-79677 CVE-2026-86248 CVE-2026-86350 CVE-2026-87022 tomcat: various flaws [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121.
The following versions were EOS at the time the CVE was created but are kn
Bugzilla
CVE-2026-77762 tomcat: Apache Tomcat: Race condition allows HTTP/2 request manipulation
bugzilla·2026-09-23·CVSS 8.1
CVE-2026-77762 [HIGH] CVE-2026-77762 tomcat: Apache Tomcat: Race condition allows HTTP/2 request manipulation
CVE-2026-77762 tomcat: Apache Tomcat: Race condition allows HTTP/2 request manipulation
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.39 through 9.0.121.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fix the issue.
2026-09-23
Published