DEV Community

kozhevniko
kozhevniko

Posted on

CVE-2026-77762 and the HTTP/2 Request-Mixup Family in Apache Tomcat

#apachetomcat #cve202677762 #requestmixup #cve202686350

CVE-2026-77762 and the HTTP/2 Request-Mixup Family in Apache Tomcat

Two neighbours on one page

Apache's 11.x vulnerability list for the 15 September 2026 release places two related entries near each other. CVE-2026-86350 is titled "Regression in fix for CVE-2026-41293 can trigger request header mix-up" and affects 11.0.22 through 11.0.25. CVE-2026-77762 is titled "Stale HPACK emitter injects trailers into recycled pooled Request" and affects 11.0.0-M1 through 11.0.25. Both describe HTTP/2 messages arriving at a peer with content that does not belong to the request the client sent. They differ in which part of the message is contaminated.

Headers versus trailers

CVE-2026-86350 is an inconsistency in how HTTP/2 requests are interpreted, introduced by an earlier fix, and it produces a header mix-up. CVE-2026-77762 is a race, and it contaminates trailers. The distinction is practical rather than academic. Header mix-up can move values that routing, authentication or caching layers read before the body, so the blast radius starts at the framework. Trailer injection arrives late in the message and only matters where application code looks for it.
The thread that connects them is state handling on recycled HTTP/2 connections. Header blocks are HPACK-compressed against a dynamic table both peers track. An emitter that is not reset before the slot is reused writes against a context the peer no longer agrees with, and the evidence ends up attached to the wrong stream.

Exploitation conditions for 77762

Concurrency is required. The attacker has to push enough parallel HTTP/2 traffic to make the pool hand a recycled request over at the wrong instant, and the receiving service has to consume trailer fields for the injection to have any effect. Apache rates the entry Low and records the fix as commit fd309997. The identifier was reported on 21 August 2026 and published on 23 September 2026.

Impact

Attacker-influenced trailer values inside another user's request. There is no authentication bypass, no code execution, and no confirmed in-the-wild use reported by the collection source, which lists CVSS 8.1 and CWE-362 for this identifier.

Affected products

Apache Tomcat 11.0.0-M1 to 11.0.25 for CVE-2026-77762, and 11.0.22 to 11.0.25 for the header mix-up issue. Tomcat 11.0.26 fixes both.

Exposure

ZoomEye returns 580,597 instances for app="Apache Tomcat". Querying vul.cve="CVE-2026-77762" yields no hosts, and neither of these two flaws changes anything a scanner can see from outside a response.
Search link: https://www.zoomeye.ai/searchResult?q=YXBwPSJBcGFjaGUgVG9tY2F0Ig%3D%3D

Remediation and mitigations

Upgrade to 11.0.26. While that is in flight, treat HTTP/2 termination as a trust boundary and stop treating trailer fields as a source of integrity-bearing metadata inside application code. That is a defensive posture rather than a documented Apache workaround; the advisory itself names only the code fix.

References

Top comments (0)