CVE-2026-78437

Cve • September 23, 2026

Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail. This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

CWE-459 : Incomplete cleanup

Default Status: unaffected

external site vendor-advisory

This container includes required additional information provided by the CVE Program for this vulnerability.

external site

Authorized Data Publishers

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities Discovered in Apache Tomcat Five critical vulnerabilities have been identified in Apache Tomcat, affecting versions from 8.5.0 to 11.0.25. These include CVE-2026-77762, a race condition allowing HTTP/2 request injection; CVE-2026-78383, enabling denial of service via unauthenticated AJP requests; CVE-2026-77791, which allows DoS attacks through uncontrolled resource consumption; CVE-2026-78437, related to incomplete cleanup causing request failures; and CVE-2026-86350, a regression causing HTTP request smuggling. Users are advised to upgrade to the latest versions (11.0.26, 10.1.60, or 9.0.122) to mitigate these vulnerabilities. The vulnerabilities impact both supported and end-of-life versions of Apache Tomcat, posing significant risks to web applications relying on this server software. 5 sources 61

Extracted Entities

CVE-2026-78437

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Platforms (1)

Vulnerabilities (1)