Loading vulnerability…
Apache Tomcat HTTP/2 Backlog Allocation Leak Denial of Service
CVE-2026-68763 is an uncontrolled resource consumption vulnerability in Apache Tomcat caused by an allocation leak in HTTP/2 backlog tracking when a stream is reset. Repeated triggering can consume server resources and cause denial of service. Affected versions are 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.39 through 9.0.120. End-of-life versions 8.5.59 through 8.5.100 are also known to be affected; other unsupported versions may be affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote, unauthenticated attacker can exhaust resources in an affected Tomcat instance, degrading availability or causing denial of service for hosted applications and dependent services. The vulnerability has a CVSS v3.1 base score of 7.5, with high availability impact and no identified confidentiality or integrity impact.
If you can’t patch tonight, do this now.
Until patched, disable HTTP/2 on affected Tomcat connectors where operationally feasible, or restrict access to the HTTP/2 service. Apply connection and stream-reset rate controls at an upstream proxy or load balancer where supported. Monitor Tomcat resource consumption and unusual HTTP/2 reset activity. These measures reduce exposure but do not repair the allocation leak.
Patch, then assume compromise.
Upgrade Apache Tomcat to 11.0.25 or later, 10.1.58 or later, or 9.0.121 or later within the appropriate supported release branch. Migrate affected Tomcat 8.5 installations to a supported, fixed release. For bundled or distribution-managed Tomcat, apply the applicable vendor update rather than independently replacing embedded components. Identified fixed product releases include Confluence 9.2.26, 10.2.19, or 11.0.0; JBoss Web Server 6.2.5 or 7.0.2; HCL Launch 7.3.2.22; and HCL DevOps Deploy 8.0.1.17, 8.1.2.10, or 8.2.2.3, as appropriate for the deployed branch.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
29 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.