CVE-2026-78383: Apache Tomcat AJP DOS Vulnerability

CVE-2026-78383 Overview

CVE-2026-78383 is a denial of service vulnerability in Apache Tomcat's Apache JServ Protocol (AJP) connector. An unauthenticated attacker can send a crafted AJP request that pins a processing thread indefinitely. Repeated requests exhaust the AJP thread pool and prevent legitimate traffic from being served.

The root weakness is classified as [CWE-770] Allocation of Resources Without Limits or Throttling. The Apache Tomcat project has released fixed versions 11.0.26, 10.1.60, and 9.0.122.

Critical Impact
A single unauthenticated network attacker can exhaust AJP worker threads, rendering the Tomcat server unresponsive to backend AJP traffic from front-end web servers.

Affected Products

Apache Tomcat 11.0.0-M1 through 11.0.25
Apache Tomcat 10.1.0-M1 through 10.1.59
Apache Tomcat 9.0.0.M1 through 9.0.121
End-of-life branches also affected: 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109

Discovery Timeline

2026-09-23 - CVE-2026-78383 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-78383

Vulnerability Analysis

Apache Tomcat exposes the AJP connector to allow reverse proxies such as Apache HTTP Server or nginx to forward requests over a binary protocol. The connector assigns each inbound AJP connection to a worker thread from a bounded pool. This vulnerability allows an attacker to craft an AJP request that causes the assigned processing thread to remain occupied instead of returning to the pool.

Because the AJP thread pool is finite, an attacker can repeat this request pattern to pin every available worker. Once all threads are pinned, the connector cannot service additional AJP traffic. Front-end proxies relying on AJP will see connection timeouts or errors, resulting in a full application-tier outage.

The attack requires no authentication and no user interaction. It targets availability only; confidentiality and integrity are not directly affected. Environments that expose the AJP connector to untrusted networks are at highest risk.

Root Cause

The underlying defect is missing enforcement of resource limits on AJP request processing, corresponding to [CWE-770]. The AJP processing path lacks a bounded state or timeout that guarantees a thread will be released after a malformed or stalled request.

Attack Vector

Exploitation occurs over the network against the AJP connector port, typically TCP 8009. The attacker opens repeated AJP sessions and sends the triggering request pattern until all worker threads are consumed. No credentials or prior access are required. Technical specifics are described in the Apache Mailing List Thread and the Openwall OSS Security Update.

Detection Methods for CVE-2026-78383

Indicators of Compromise

Sustained saturation of the AJP connector thread pool with long-lived worker threads that never return to idle state.
Spikes in inbound connections to TCP port 8009 (or the configured AJP port) from unexpected source addresses.
Front-end proxy logs showing repeated 502 or 504 responses from the Tomcat backend during an attack window.

Detection Strategies

Monitor Tomcat JMX metrics for the AJP executor's currentThreadsBusy and activeCount counters trending toward maxThreads without corresponding request completions.
Alert on network flows to the AJP port originating from outside the trusted reverse-proxy segment.
Correlate AJP connector health with application response-time degradation to distinguish this DoS from load spikes.

Monitoring Recommendations

Enable Tomcat access logging on the AJP connector and forward logs to a centralized analytics platform for baseline and anomaly analysis.
Track TCP connection counts, half-open sessions, and long-duration connections to the AJP listener.
Configure alerts when thread-pool utilization exceeds a defined threshold for more than a short window.

How to Mitigate CVE-2026-78383

Immediate Actions Required

Upgrade Apache Tomcat to 11.0.26, 10.1.60, or 9.0.122 as applicable to your branch.
Restrict network access to the AJP connector so that only trusted reverse proxies can reach TCP 8009.
If the AJP connector is not required, disable it by removing or commenting the Connector element in server.xml.

Patch Information

The Apache Tomcat project has published fixed releases 11.0.26, 10.1.60, and 9.0.122. End-of-life branches 8.5.x and 7.0.x are also affected but will not receive fixes; migrate to a supported branch. Refer to the Apache Mailing List Thread for release details.

Workarounds

Bind the AJP connector to 127.0.0.1 or an internal management interface using the address attribute in server.xml.
Enforce host-based firewall rules that permit AJP traffic only from authorized front-end proxy IPs.
Reduce the connectionTimeout on the AJP connector to shorten the window during which a stalled thread remains pinned.
Disable the AJP connector entirely if the deployment uses only HTTP/HTTPS connectors.

bash

# Configuration example: bind AJP to localhost and enforce a short timeout in server.xml
<Connector protocol="AJP/1.3"
           address="127.0.0.1"
           port="8009"
           connectionTimeout="5000"
           secretRequired="true"
           secret="REPLACE_WITH_STRONG_SECRET" />