A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could t

Summary

A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.

Timeline

1. Jun 26, 2020, 4:27 PM UTCCVE published
2. Oct 8, 2026, 9:09 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Oct 8, 2026, 9:13 PM UTCRecord last updated
4. Oct 22, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Apache Apache Tomcat

  10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35, 8.5.0 to 8.5.55

• tomcatBitnami

  From 8.5.0 · fixed in 8.5.56; From 9.0.0 · fixed in 9.0.36

• org.apache.tomcat:tomcatMaven

  From 10.0.0-M1 · fixed in 10.0.0-M5

• org.apache.tomcat:tomcatMaven

  From 9.0.0.M1 · fixed in 9.0.35

• org.apache.tomcat:tomcatMaven

  From 8.5.0 · fixed in 8.5.55

• org.apache.tomcat.embed:tomcat-embed-coreMaven

  From 10.0.0-M1 · fixed in 10.0.0-M5

• org.apache.tomcat.embed:tomcat-embed-coreMaven

  From 9.0.0.M1 · fixed in 9.0.35

• org.apache.tomcat.embed:tomcat-embed-coreMaven

  From 8.5.0 · fixed in 8.5.55

References 24