DEBIAN-CVE-2026-77762

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-77762
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-77762.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-77762
Upstream
  • CVE-2026-77762
Published
2026-09-23T12:17:06Z
Modified
2026-09-24T05:00:10Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.39 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fix the issue.

References

Affected packages

Debian:12
tomcat10

Package

Name
tomcat10
Purl
pkg:deb/debian/tomcat10?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

10.*
10.1.6-1
10.1.6-1+deb12u1
10.1.6-1+deb12u2
10.1.7-1
10.1.8-1
10.1.9-1
10.1.10-1
10.1.13-1
10.1.14-1
10.1.15-1
10.1.16-1
10.1.20-1
10.1.23-1
10.1.25-1~bpo12+1
10.1.25-1
10.1.25-2
10.1.30-1~bpo12+1
10.1.30-1
10.1.31-1
10.1.33-1~bpo12+1
10.1.33-1
10.1.34-0+deb12u1
10.1.34-0+deb12u2
10.1.34-1
10.1.35-1
10.1.40-1~bpo12+1
10.1.40-1
10.1.46-1
10.1.52-1~deb12u1
10.1.52-1~deb13u1
10.1.52-1
10.1.52-2
10.1.54-1
10.1.55-1~deb12u1
10.1.55-1~deb13u1
10.1.55-1
10.1.60-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-77762.json"
tomcat9

Package

Name
tomcat9
Purl
pkg:deb/debian/tomcat9?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.0.70-2

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-77762.json"
Debian:13
tomcat10

Package

Name
tomcat10
Purl
pkg:deb/debian/tomcat10?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

10.*
10.1.40-1
10.1.46-1
10.1.52-1~deb12u1
10.1.52-1~deb13u1
10.1.52-1
10.1.52-2
10.1.54-1
10.1.55-1~deb12u1
10.1.55-1~deb13u1
10.1.55-1
10.1.60-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-77762.json"
tomcat11

Package

Name
tomcat11
Purl
pkg:deb/debian/tomcat11?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

11.*
11.0.6-1
11.0.11-1
11.0.15-1~deb13u1
11.0.15-1
11.0.18-1
11.0.21-1
11.0.22-1~deb13u1
11.0.22-1
11.0.22-2
11.0.24-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-77762.json"
tomcat9

Package

Name
tomcat9
Purl
pkg:deb/debian/tomcat9?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.0.70-2

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-77762.json"
Debian:14
tomcat10

Package

Name
tomcat10
Purl
pkg:deb/debian/tomcat10?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

10.*
10.1.40-1
10.1.46-1
10.1.52-1~deb12u1
10.1.52-1~deb13u1
10.1.52-1
10.1.52-2
10.1.54-1
10.1.55-1~deb12u1
10.1.55-1~deb13u1
10.1.55-1
10.1.60-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-77762.json"
tomcat11

Package

Name
tomcat11
Purl
pkg:deb/debian/tomcat11?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

11.*
11.0.6-1
11.0.11-1
11.0.15-1~deb13u1
11.0.15-1
11.0.18-1
11.0.21-1
11.0.22-1~deb13u1
11.0.22-1
11.0.22-2
11.0.24-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-77762.json"
tomcat9

Package

Name
tomcat9
Purl
pkg:deb/debian/tomcat9?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.0.70-2

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-77762.json"