CVE-2026-78437

Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail. This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/qkmsos3s8chn5053qr466rzwv6sk5gjg
http://www.openwall.com/lists/oss-security/2026/09/23/26

Configurations

No configuration.

History

23 Sep 2026, 19:19

Type	Values Removed	Values Added
References		() http://www.openwall.com/lists/oss-security/2026/09/23/26 -

23 Sep 2026, 17:17

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.3

23 Sep 2026, 12:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-23 12:17

Updated : 2026-09-23 19:19

NVD link : CVE-2026-78437

Mitre link : CVE-2026-78437

CVE.ORG link : CVE-2026-78437

JSON object : View

Products Affected

No product.

CWE

CWE-459

Incomplete Cleanup

{"id": "CVE-2026-78437", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78437", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-23T16:25:38.365317Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Tomcat", "versions": [{"status": "affected", "version": "11.0.19", "versionType": "semver", "lessThanOrEqual": "11.0.25"}, {"status": "affected", "version": "10.1.53", "versionType": "semver", "lessThanOrEqual": "10.1.59"}, {"status": "affected", "version": "9.0.116", "versionType": "semver", "lessThanOrEqual": "9.0.121"}, {"status": "unaffected", "version": "0", "versionType": "semver", "lessThanOrEqual": "8.5.100"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-23T12:17:07.340", "references": [{"url": "https://lists.apache.org/thread/qkmsos3s8chn5053qr466rzwv6sk5gjg", "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/09/23/26", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-459"}]}], "descriptions": [{"lang": "en", "value": "Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue."}], "lastModified": "2026-09-23T19:19:21.640", "sourceIdentifier": "security@apache.org"}