CVE-2026-68763

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-68763
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68763.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-68763
Aliases
Downstream
Published
2026-08-25T22:00:37.047Z
Modified
2026-08-28T16:55:35.784654739Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset
Details

Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120.

The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68763.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "11.0.0-M1"
                },
                {
                    "last_affected": "11.0.24"
                },
                {
                    "introduced": "10.1.0-M1"
                },
                {
                    "last_affected": "10.1.57"
                },
                {
                    "introduced": "9.0.39"
                },
                {
                    "last_affected": "9.0.120"
                },
                {
                    "introduced": "8.5.59"
                },
                {
                    "last_affected": "8.5.100"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "introduced": "11.0.0-M1"
                },
                {
                    "fixed": "11.0.24"
                },
                {
                    "introduced": "10.1.0-M1"
                },
                {
                    "fixed": "10.1.57"
                },
                {
                    "introduced": "9.0.39"
                },
                {
                    "fixed": "9.0.120"
                },
                {
                    "introduced": "8.5.59"
                },
                {
                    "fixed": "8.5.100"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-400"
    ],
    "cna_assigner": "apache"
}
References

Affected packages

Git / github.com/apache/tomcat

Affected ranges

Type
GIT
Repo
https://github.com/apache/tomcat
Events
Introduced
59c81e30e2f64f5e8c1db78c4860c51850dfb0bd
Fixed
4f33a9eca48c5cbf5963dd213b74866e629154ad
Introduced
f2ab9ac8bc3f40ee9b2cb50b030c99df927f0429
Fixed
5da21b1c24a6443bca5c10dc80a69a76042ca337
Introduced
6989c4e9360b4f9443862968c15a95d17f264321
Fixed
8fc613dd46061308028b75ed99571db00b9db4e0
Introduced
c042ec71219dbde3e1ce0381ce5be0801120d0fa
Fixed
eddcf278ad919382608ada1898b2c5b63675c6d5
Database specific
Show details 
{
    "source": "DESCRIPTION",
    "extracted_events": [
        {
            "introduced": "11.0.0-M1"
        },
        {
            "fixed": "11.0.24"
        },
        {
            "introduced": "10.1.0-M1"
        },
        {
            "fixed": "10.1.57"
        },
        {
            "introduced": "9.0.39"
        },
        {
            "fixed": "9.0.120"
        },
        {
            "introduced": "8.5.59"
        },
        {
            "fixed": "8.5.100"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68763.json"