CVE-2026-68763

Analyzed Analyzed - Analysis Complete

Uncontrolled Resource Consumption in Apache Tomcat

Publication date: 2026-08-25

Last updated on: 2026-08-27

Assigner: Apache Software Foundation

Description

Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-27

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-13

NVD

CVE-2026-68763

EUVD

EUVD-2026-66190

Affected Vendors & Products

Vendor	Product	Version / Range
apache	tomcat	From 10.1.0 (inc) to 10.1.58 (exc)
apache	tomcat	From 11.0.0 (inc) to 11.0.25 (exc)
apache	tomcat	From 8.5.59 (inc) to 9.0.121 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This is an uncontrolled resource consumption vulnerability in Apache Tomcat caused by an allocation leak in HTTP/2 backlog tracking when a stream is reset. This means the server may consume excessive memory or CPU resources under certain conditions, potentially leading to degraded performance or denial of service.

Detection Guidance

This vulnerability involves an allocation leak in HTTP/2 backlog tracking when a stream is reset. Detection requires monitoring for unusual resource consumption patterns in Tomcat's HTTP/2 processing. Check Tomcat logs for frequent stream resets or increased memory usage. Use system monitoring tools like top, htop, or ps to observe Tomcat's memory and CPU usage over time. Look for Tomcat processes consuming excessive memory without corresponding request loads.

Impact Analysis

The vulnerability could cause your Apache Tomcat server to slow down or crash due to excessive resource usage. This may disrupt services relying on the server, such as web applications, leading to downtime or reduced availability.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service attacks through resource exhaustion, which may disrupt services handling sensitive data. Uncontrolled resource consumption could lead to system instability or downtime, affecting availability requirements under these regulations.

Mitigation Strategies

Upgrade Apache Tomcat to a fixed version immediately: 11.0.25, 10.1.58, or 9.0.121. If using an affected version (8.5.59-8.5.100), upgrade to one of these versions as well. Disable HTTP/2 if not required by setting 'protocol="org.apache.coyote.http11.Http11NioProtocol"' in server.xml. Monitor Tomcat's memory usage and restart the service if abnormal consumption is detected.

Hi! I’m here to help you understand CVE-2026-68763. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70