Description

Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-25T22:17:05.970Z",
  "pubdate": "2026-08-25T22:17:05.970Z",
  "executiveSummary": "This vulnerability is an Uncontrolled Resource Consumption issue identified in Apache Tomcat involving the HTTP/2 protocol implementation.\nThe flaw stems from an allocation leak within the HTTP/2 backlog tracking mechanism, specifically triggered when a stream reset occurs during processing.\nThis vulnerability affects Apache Tomcat versions 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, 9.0.39 through 9.0.120, and 8.5.59 through 8.5.100.\nSuccessful exploitation allows a remote, unauthenticated attacker to induce memory or resource exhaustion by repeatedly triggering stream resets.\nThis leads to a denial-of-service (DoS) condition, as the server fails to reclaim allocated resources associated with the tracked backlog, eventually depleting available system memory or exceeding resource limits.\nThe risk is significant due to the ease of exploitation, as it requires only standard HTTP/2 traffic without specific authentication or elevated privileges.",
  "technicalDetails": "The vulnerability resides in the HTTP/2 implementation logic within Apache Tomcat, specifically concerning the management of the HTTP/2 stream backlog tracking.\nIn the HTTP/2 protocol, a stream may be reset (RST_STREAM) by either the client or the server before it reaches completion. The flaw exists in the internal accounting mechanism responsible for tracking the backlog of pending HTTP/2 streams. When a stream is reset under specific conditions, the tracking object responsible for the stream's backlog allocation is not correctly decremented or released.\nThe root cause is an allocation leak where the state management fails to account for the premature termination of the stream. Because the tracking object remains referenced or allocated in memory despite the stream's cessation, the internal backlog counter effectively becomes corrupted, permanently indicating more active or queued traffic than is actually present.\nExploitation involves an attacker initiating a high volume of HTTP/2 stream requests and subsequently sending RST_STREAM frames for those streams. By timing the reset frames to coincide with the backlog tracking increment, the attacker forces the server to leak resource handles or memory slots associated with these tracking objects.\nThe attack flow proceeds as follows: 1) The attacker establishes a valid HTTP/2 connection with the target Tomcat server. 2) The attacker issues multiple concurrent requests that trigger the backlog tracking mechanism. 3) The attacker proactively sends RST_STREAM frames to abort these requests. 4) The server logic fails to decrement the backlog counter associated with these specific streams due to the incomplete state cleanup. 5) Repeated execution of this sequence leads to the exhaustion of the configured HTTP/2 stream concurrency limits or overall system heap memory.\nThis results in a denial-of-service, as the server reaches a state where it can no longer accept new streams or perform necessary tasks due to the exhausted resource pool. This vulnerability is remotely exploitable over a network without requiring authentication, and it does not necessitate administrative privileges. The persistence of the leak means that even without a massive surge of traffic, an attacker can incrementally exhaust server resources over time, leading to service instability and eventual unavailability."
}