CVE-2026-78437: Apache Tomcat Race Condition Vulnerability

CVE-2026-78437 Overview

CVE-2026-78437 is an incomplete cleanup vulnerability [CWE-459] in Apache Tomcat. A malformed HTTP request can leave residual state in the server that, depending on timing, causes an unrelated request from another user to fail. The flaw affects Apache Tomcat versions 11.0.19 through 11.0.25, 10.1.53 through 10.1.59, and 9.0.116 through 9.0.121. The Apache Software Foundation recommends upgrading to 11.0.26, 10.1.60, or 9.0.122. The issue is exploitable over the network without authentication or user interaction.

Critical Impact
A remote unauthenticated attacker can send malformed requests that cause legitimate requests from other users to fail, producing cross-user request disruption and degraded availability.

Affected Products

Apache Tomcat 11.0.19 through 11.0.25
Apache Tomcat 10.1.53 through 10.1.59
Apache Tomcat 9.0.116 through 9.0.121

Discovery Timeline

2026-09-23 - CVE-2026-78437 published to the National Vulnerability Database
2026-09-23 - Apache Software Foundation security discussion published
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-78437

Vulnerability Analysis

The vulnerability is classified as incomplete cleanup [CWE-459]. Apache Tomcat fails to fully release or reset internal state after processing a malformed request. Residual state persists on shared server resources such as connection buffers, request processors, or thread-local data structures.

When a subsequent request from a different user is processed on the affected worker, the leftover state can interfere with request parsing or dispatch. The result is a failed request for the second user. The failure is timing-dependent because it requires the malformed request and the victim request to share the same reused resource within a narrow window.

The impact is limited to integrity and availability of individual requests. It does not directly enable code execution or persistent data exposure. However, repeated exploitation can produce sustained request failures across users of a shared Tomcat instance.

Root Cause

The root cause lies in Tomcat's request-processing pipeline, which does not fully clear internal state when a request is rejected as malformed. Reusable components in the connector or processor pool retain fragments of the prior request's state, violating the isolation expected between successive HTTP requests.

Attack Vector

An attacker sends a specifically crafted malformed HTTP request over the network to an exposed Tomcat listener. No credentials or user interaction are required. If a legitimate user's request is subsequently dispatched to the same reused worker or buffer, that request fails. Reliable exploitation depends on winning a timing race against real user traffic. Refer to the Apache Security Discussion and the OpenWall OSS Security Update for upstream technical detail.

Detection Methods for CVE-2026-78437

Indicators of Compromise

Elevated rates of HTTP 400 or 500 responses in Tomcat access logs without a corresponding change in legitimate client behavior.
Parser or processor exceptions in catalina.out referencing malformed request lines, headers, or chunked encoding.
Bursts of short, malformed requests from a small set of source IPs directly followed by user-reported request failures.

Detection Strategies

Correlate malformed request events with subsequent failed requests from unrelated client IPs on the same worker thread or connector.
Baseline the normal ratio of malformed to well-formed requests per connector and alert on statistically significant deviations.
Inspect WAF and reverse proxy logs for request patterns that violate HTTP grammar and are forwarded to Tomcat backends.

Monitoring Recommendations

Enable verbose access logging including request-line status and processing time for all Tomcat connectors.
Ship Tomcat access and error logs to a centralized analytics platform to correlate malformed requests with downstream failures across users.
Track the installed Apache Tomcat version across the estate and alert on any host still running an affected release.

How to Mitigate CVE-2026-78437

Immediate Actions Required

Upgrade Apache Tomcat to 11.0.26, 10.1.60, or 9.0.122 according to the deployed branch.
Inventory all Tomcat instances, including embedded deployments inside Spring Boot and other application bundles, to confirm patch coverage.
Place a hardened reverse proxy or WAF in front of Tomcat to reject malformed HTTP requests before they reach the affected connectors.

Patch Information

The Apache Software Foundation has released fixed versions 11.0.26, 10.1.60, and 9.0.122. Details are available in the Apache Security Discussion and the OpenWall OSS Security Update.

Workarounds

Enforce strict HTTP request validation at an upstream proxy or WAF to drop malformed requests before Tomcat processes them.
Restrict direct network exposure of Tomcat connectors so only trusted proxies can reach them.
Rate-limit and block source IPs that generate repeated malformed requests to reduce the probability of a successful timing race.

bash

# Verify installed Tomcat version and confirm it is a fixed release
$CATALINA_HOME/bin/version.sh | grep -i 'server version'

# Example: reject malformed requests at an NGINX reverse proxy in front of Tomcat
# nginx.conf
server {
    listen 443 ssl;
    server_name app.example.com;

    # Drop obviously malformed requests early
    if ($request_method !~ ^(GET|HEAD|POST|PUT|DELETE|OPTIONS|PATCH)$) {
        return 405;
    }
    ignore_invalid_headers on;
    underscores_in_headers off;

    location / {
        proxy_pass http://tomcat_backend;
        proxy_http_version 1.1;
    }
}