CVE-2026-68763: Apache Tomcat HTTP/2 DOS Vulnerability

CVE-2026-68763 Overview

CVE-2026-68763 is an uncontrolled resource consumption vulnerability [CWE-400] in Apache Tomcat. The flaw exists in the HTTP/2 backlog tracking logic and manifests as an allocation leak when a stream is reset. Remote unauthenticated attackers can exploit the issue over the network with low complexity to exhaust server resources and cause a denial of service.

Apache Tomcat is one of the most widely deployed Java servlet containers. The affected code paths execute during normal HTTP/2 request handling, which broadens the exposure across internet-facing deployments.

Critical Impact
Remote unauthenticated attackers can trigger a memory allocation leak by resetting HTTP/2 streams, exhausting server resources and causing denial of service on affected Tomcat instances.

Affected Products

Apache Tomcat 11.0.0-M1 through 11.0.24
Apache Tomcat 10.1.0-M1 through 10.1.57
Apache Tomcat 9.0.39 through 9.0.120
Apache Tomcat 8.5.59 through 8.5.100 (EOL, unsupported)

Discovery Timeline

2026-08-25 - CVE-2026-68763 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-68763

Vulnerability Analysis

The vulnerability resides in Apache Tomcat's HTTP/2 implementation, specifically in the code that tracks the backlog of pending stream allocations. HTTP/2 multiplexes multiple concurrent streams over a single TCP connection, and Tomcat maintains internal accounting structures to manage per-stream resources such as flow control windows and buffer allocations.

When a client resets a stream using an RST_STREAM frame, Tomcat should release any resources associated with that stream and decrement its backlog tracking counters. In affected versions, the reset path fails to release the tracked allocation, leaving the accounting entry in place after the stream terminates. Repeated open-then-reset patterns cause the leak to accumulate across the lifetime of the connection.

The issue is classified as an uncontrolled resource consumption weakness. Impact is limited to availability, with no confidentiality or integrity consequences.

Root Cause

The root cause is a missing cleanup step in the HTTP/2 stream reset handler. The backlog tracking counters used to enforce concurrency and memory limits are not decremented when a stream is prematurely reset, resulting in a persistent allocation leak. Over time, this drives the server toward its configured limits and eventually starves legitimate request handling.

Attack Vector

An attacker only needs network reachability to the Tomcat HTTP/2 listener. No authentication or user interaction is required. By repeatedly opening HTTP/2 streams and immediately sending RST_STREAM frames, an attacker can inflate the tracked backlog until the server refuses new work or degrades to the point of unavailability. This pattern is similar to the family of HTTP/2 rapid reset abuses that have affected multiple web server implementations.

No verified public proof-of-concept code has been published. Refer to the Apache Mailing List Thread and the OpenWall OSS Security Update for the vendor advisory.

Detection Methods for CVE-2026-68763

Indicators of Compromise

Sustained high volume of HTTP/2 RST_STREAM frames originating from a small set of client IP addresses.
Growing Tomcat JVM heap usage and thread counts without a corresponding increase in completed requests.
Log entries showing HTTP/2 stream limits being reached or connections closed with ENHANCE_YOUR_CALM or similar protocol errors.

Detection Strategies

Enable HTTP/2 protocol-level logging and alert on abnormal ratios of stream resets to completed requests per connection.
Monitor Tomcat Connector metrics via JMX for unexpected growth in active stream counts or allocated buffers.
Correlate reverse proxy and WAF telemetry with backend Tomcat resource metrics to identify clients driving reset floods.

Monitoring Recommendations

Baseline normal HTTP/2 stream and reset rates per source and alert on statistically significant deviations.
Track JVM memory, garbage collection duration, and thread pool saturation on Tomcat hosts to detect resource exhaustion early.
Ingest Tomcat access and catalina logs into a centralized analytics platform to enable retroactive hunting for reset-based abuse patterns.

How to Mitigate CVE-2026-68763

Immediate Actions Required

Upgrade Apache Tomcat to a fixed version: 11.0.25, 10.1.58, or 9.0.121.
Retire any Tomcat 8.5.x deployment, as the branch is end-of-life and will not receive fixes.
Restrict direct exposure of Tomcat HTTP/2 listeners to the internet by placing a hardened reverse proxy in front where feasible.

Patch Information

The Apache Tomcat project addressed the allocation leak in versions 11.0.25, 10.1.58, and 9.0.121. Administrators should follow the vendor advisory in the Apache Mailing List Thread for release notes and upgrade guidance. There is no evidence of exploitation in the wild and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at this time.

Workarounds

Disable HTTP/2 on the Tomcat Connector if the protocol is not required by application clients.
Tune maxConcurrentStreams and connection-level limits to constrain the impact of reset floods until patching is complete.
Deploy a reverse proxy or WAF capable of rate-limiting HTTP/2 RST_STREAM frames per connection and per source IP.

bash

# Example: disable HTTP/2 upgrade protocol on a Tomcat Connector in server.xml
# Remove or comment out the UpgradeProtocol element to fall back to HTTP/1.1
# <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
#            SSLEnabled="true" maxThreads="200">
#     <!-- <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol"
#                          maxConcurrentStreams="100" /> -->
# </Connector>