cyfenced.com →

[ CVE-2026-78437 · Published 23 Sep 2026 ]

Vulnerability in Apache Software Foundation Apache Tomcat

CVSS 7.3 EPSS <1%2 agency advisoriesNo fix listed yet

[ Description ]Official description

Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail. This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

  • CERT-FRCERTFR-2026-AVI-1336

    Multiple vulnerabilities in IBM products Translated from French

    Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

    CVE-2026-14671CVE-2026-11548CVE-2022-22950+490 more CVEs
  • CERT-FRCERTFR-2026-AVI-1218

    Multiple vulnerabilities in Apache Tomcat Translated from French

    Multiple vulnerabilities have been discovered in Apache Tomcat. Some of them allow an attacker to cause remote denial of service, a breach of data integrity and a security policy bypass.

    CVE-2026-77791CVE-2026-76183CVE-2026-77756+11 more CVEs

[ References ]References