DEV Community

jeffrey
jeffrey

Posted on

Apache Tomcat CVE-2026-77762: A Stale HPACK Emitter Leaks Trailers Between HTTP/2 Requests

#apachetomcat #cve202677762 #http2 #hpack

Apache Tomcat CVE-2026-77762: A Stale HPACK Emitter Leaks Trailers Between HTTP/2 Requests

Overview

Apache Tomcat 11.0.26, dated 15 September 2026 on the project's 11.x vulnerability page, closes a batch of defects reported privately to the Tomcat security team. One of them is CVE-2026-77762, entered under the heading "Stale HPACK emitter injects trailers into recycled pooled Request". The Tomcat team rates it Low. The collection source that flagged the release maps the same identifier to CWE-362, Race Condition, and lists a CVSS score of 8.1, so defenders will see a wide gap between the vendor rating and the third-party score. The report reached the security team on 21 August 2026, the issue became public on 23 September 2026, and the code fix is commit fd309997.

What the race condition does

HTTP/2 header blocks travel as HPACK-compressed data, and the compression context each endpoint keeps is stateful. In Tomcat that state lives with the emitter that writes HTTP/2 messages on a pooled connection. When a request object goes back into the pool and is handed to a different user, the emitter has to be reset so the next message starts from a clean context. CVE-2026-77762 is a race in exactly that handover: a stale emitter could survive long enough to write trailer fields belonging to one exchange into another HTTP/2 request that had already been recycled.
The window is a timing one on the server side, so the attacker needs to be able to issue concurrent HTTP/2 requests and reach the recycled connection at the right moment. Trailers arrive after the body of a message, which means code that reads headers and payload and never inspects trailers will not observe the injected fields. That detail shapes both the detection story and the practical severity.

Impact

The concrete effect is cross-request contamination: attacker-influenced trailer fields can appear in a request that another client believes it sent cleanly. What happens next depends entirely on the application. A service that consumes trailers for signatures, metadata or routing hints could be made to act on values it never intended to accept. Services that ignore trailers are unlikely to notice anything, which is consistent with the Low rating attached by the Apache team.

Affected versions

Tomcat 11.0.0-M1 through 11.0.25 on the 11.0.x line are listed as affected. Version 11.0.26 contains the fix.

Exposure context

A ZoomEye search for app="Apache Tomcat" returns 580,597 instances worldwide. That number describes the size of the Tomcat footprint rather than the count of vulnerable deployments. A CVE-keyed search for vul.cve="CVE-2026-77762" returns no matching hosts, because this defect is a server-side race and nothing in an HTTP response advertises it. Version data has to come from asset inventory.
Search link: https://www.zoomeye.ai/searchResult?q=YXBwPSJBcGFjaGUgVG9tY2F0Ig%3D%3D

Remediation

Upgrade to Tomcat 11.0.26 or later. The advisory publishes no stand-alone configuration workaround for this specific issue; the documented fix is the code change in commit fd309997, which ships in 11.0.26. Because the same release also carries fixes for the HTTP/2 request header mix-up (CVE-2026-86350), the AJP denial of service (CVE-2026-78383), WebSocket message smuggling (CVE-2026-87022) and the WebSocket close busy-wait denial of service (CVE-2026-77791), treating 11.0.26 as a single upgrade target is more efficient than chasing individual identifiers.

References

Top comments (0)