CVE-2026-77762: Apache Tomcat Race Condition Vulnerability

CVE-2026-77762 Overview

CVE-2026-77762 is a race condition vulnerability in Apache Tomcat that allows an attacker to inject trailer fields into another HTTP/2 request. The flaw stems from concurrent execution using shared resources with improper synchronization [CWE-362]. An attacker exploiting this weakness can cross request boundaries and manipulate the data another user's request carries into the server.

The issue affects Apache Tomcat versions 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.39 through 9.0.121. End-of-life branches 8.5.59 through 8.5.100 are also affected. Fixed releases are 11.0.26, 10.1.60, and 9.0.122.

Critical Impact
Remote attackers can inject HTTP/2 trailer fields into concurrent requests, enabling request tampering with high confidentiality, integrity, and availability impact.

Affected Products

Apache Tomcat 11.0.0-M1 through 11.0.25
Apache Tomcat 10.1.0-M1 through 10.1.59
Apache Tomcat 9.0.39 through 9.0.121 (and EOL 8.5.59 through 8.5.100)

Discovery Timeline

2026-09-23 - CVE-2026-77762 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77762

Vulnerability Analysis

The vulnerability resides in Apache Tomcat's HTTP/2 request processing pipeline. HTTP/2 multiplexes many concurrent streams over a single connection, and Tomcat processes those streams using shared internal state. When two or more streams are processed concurrently, insufficient synchronization around trailer field handling allows one stream's trailers to be attributed to a different in-flight request.

Because trailers are metadata delivered after the request body, servers and downstream applications often consume them as authoritative request headers. Successful exploitation therefore lets an attacker influence headers seen by application code handling another user's request. The impact class covers confidentiality, integrity, and availability, though the attack complexity is high because the attacker must win a timing window during concurrent HTTP/2 processing.

Root Cause

The root cause is improper synchronization of a shared resource used during HTTP/2 trailer processing [CWE-362]. Tomcat's stream handling failed to isolate trailer parsing state per request, so overlapping stream lifecycles could interleave writes to the shared structure. The fixes in versions 11.0.26, 10.1.60, and 9.0.122 correct this synchronization gap.

Attack Vector

Exploitation requires only network access to a vulnerable HTTP/2 endpoint. No authentication or user interaction is needed. The attacker opens multiple concurrent HTTP/2 streams and issues a crafted request containing trailer fields, timing the delivery so that the trailers are applied to a parallel request originating from another client.

Refer to the Apache Mailing List Thread and the OpenWall OSS-Security Update for the vendor's technical description. No public proof-of-concept exploit is available at the time of publication.

Detection Methods for CVE-2026-77762

Indicators of Compromise

HTTP/2 requests containing unexpected or duplicated trailer fields in application access logs.
Application-layer authorization anomalies where user context or headers do not match the authenticated session.
Bursts of concurrent HTTP/2 streams from a single client aimed at latency-sensitive endpoints.

Detection Strategies

Inspect Tomcat access logs and reverse-proxy telemetry for HTTP/2 requests that carry trailer fields, which are rare in typical traffic.
Correlate application errors referencing header parsing or missing/duplicated headers with concurrent HTTP/2 activity on the same connection.
Deploy web application firewall (WAF) rules that flag or drop HTTP/2 requests containing trailer sections targeting sensitive endpoints.

Monitoring Recommendations

Track Tomcat version inventory to identify hosts running 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, or 9.0.39 through 9.0.121.
Alert on abnormal ratios of concurrent HTTP/2 streams per connection, particularly against authentication or session endpoints.
Monitor for post-patch regressions by validating trailer handling with synthetic HTTP/2 traffic in staging.

How to Mitigate CVE-2026-77762

Immediate Actions Required

Upgrade Apache Tomcat to 11.0.26, 10.1.60, or 9.0.122 on all internet-facing and internal HTTP/2 endpoints.
Retire or isolate end-of-life Tomcat 8.5.x deployments, which will not receive a fix through the supported release stream.
Review reverse proxies, load balancers, and WAFs to confirm they inspect and normalize HTTP/2 trailers before forwarding requests to Tomcat.

Patch Information

The Apache Tomcat project has released fixed versions 11.0.26, 10.1.60, and 9.0.122. Administrators should consult the Apache Mailing List Thread for the official announcement and upgrade guidance.

Workarounds

Disable HTTP/2 on the Tomcat connector where feasible and serve traffic over HTTP/1.1 until patching is complete.
Terminate HTTP/2 at an upstream proxy that strips or rejects trailer fields before requests reach Tomcat.
Restrict HTTP/2 concurrency by lowering the maximum concurrent streams per connection on the connector to reduce the exploitable timing window.

bash

# Example: disable HTTP/2 upgrade on a Tomcat connector in server.xml
# Remove or comment out the HTTP/2 UpgradeProtocol until patched
# <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
#            SSLEnabled="true" maxThreads="200">
#     <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
# </Connector>