High severity7.3NVD Advisory· Published Sep 23, 2026· Updated Sep 23, 2026
CVE-2026-78437
CVE-2026-78437
Description
Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail.
This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121.
Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
10- osv-coords9 versionspkg:bitnami/tomcatpkg:rpm/opensuse/tomcat&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/tomcat10&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/tomcat11&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/tomcat&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/libtcnative-2-0&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/tomcat10&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/libtcnative-1-0&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/tomcat11&distro=openSUSE%20Leap%2016.0
>= 9.0.116, < 9.0.122+ 8 more
- (no CPE)range: >= 9.0.116, < 9.0.122
- (no CPE)range: < 9.0.122-1.1
- (no CPE)range: < 10.1.60-1.1
- (no CPE)range: < 11.0.26-1.1
- (no CPE)range: < 9.0.122-160000.1.1
- (no CPE)range: < 2.0.16-160000.1.1
- (no CPE)range: < 10.1.60-160000.1.1
- (no CPE)range: < 1.3.9-160000.1.1
- (no CPE)range: < 11.0.26-160000.1.1
Patches
Vulnerability mechanics
References
2News mentions
4- ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware ArrestsThe Hacker News · Oct 5, 2026
- Apache: 25 Vulnerabilities Disclosed, Critical Flaws Hit Tomcat on Sep 23-24, 2026Vypr Intelligence · Sep 24, 2026
- Apache Tomcat Update Fixes WebSocket and HTTP/2 Flaws Affecting Server SecurityCyber Security News · Sep 24, 2026
- Apache Tomcat: 12 Vulnerabilities Including HTTP/2 Smuggling and Auth Bypass Disclosed TogetherVypr Intelligence · Sep 23, 2026