Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset (CVE-2026-68763)
Description
Apache Tomcat contains an uncontrolled resource consumption vulnerability due to an allocation leak in HTTP/2 backlog tracking when a stream is reset. This issue affects multiple versions across the 8.5.x, 9.0.x, 10.1.x, and 11.0.x branches. The vulnerability can lead to denial of service (DoS) conditions by exhausting server resources. Fixed versions are available and users are advised to upgrade to these versions to mitigate the issue.
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-68763 is an uncontrolled resource consumption vulnerability in Apache Tomcat caused by an allocation leak in the HTTP/2 backlog tracking mechanism when a stream is reset. This flaw affects Apache Tomcat versions from 11.0.0 through 11.0.24, 10.1.0 through 10.1.57, 9.0.39 through 9.0.120, and 8.5.59 through 8.5.100 (the latter being end-of-life versions). The issue allows an attacker to cause a denial of service by exhausting server resources. The vulnerability is addressed in Apache Tomcat versions 11.0.25, 10.1.58, and 9.0.121.
Potential Impact
Successful exploitation of this vulnerability can lead to denial of service conditions due to uncontrolled resource consumption via an allocation leak in HTTP/2 backlog tracking. This can degrade or disrupt the availability of the affected Apache Tomcat server.
Mitigation Recommendations
A fix is available. Users should upgrade affected Apache Tomcat instances to versions 11.0.25, 10.1.58, or 9.0.121 or later to remediate this vulnerability. No additional mitigation steps are indicated beyond applying the official patches.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-82jr-6mfr-9vq5
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-68763"]
- State
- PUBLISHED
Threat ID: 6a8efff4acd9273b4908ca47
Added to database: 08/26/2026, 15:02:12 UTC
Last enriched: 09/08/2026, 15:01:31 UTC
Last updated: 10/10/2026, 18:48:21 UTC
Views: 67
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.