CVE-2026-78437

HighCVSS 7.3/10Last modified Sep 23, 2026

Description

Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail.

This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121.

Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-459

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 23, 2026
Last modified
Sep 23, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-784387.2The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in CVE-2026-784398.8Stack-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.CVE-2026-78446.3A vulnerability was detected in chatchat-space Langchain-Chatchat up to 0.3.1.3. This vulnerability affects the function files/list_files/reCVE-2026-784416.5Out-of-bounds read in Windows OLE DB allows an unauthorized attacker to disclose information over a network.CVE-2026-784428.8Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to execute code over a network.CVE-2026-784448.1Untrusted pointer dereference in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.CVE-2026-784459.8Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network.CVE-2026-784467.5Use after free in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.CVE-2026-784477.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-784487.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-784498.1Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network.CVE-2026-78452.6A flaw has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. This issue affects the function PIL.Image.tobytes of the file libs
CVE-2026-78437: High severity, CVSS 7.3 | Vulnix