CVE-2026-78437: Incomplete Cleanup

September 23, 2026

Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail.

This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121.

Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

References

github.com/apache/tomcat/commit/70579060454a203977b5696ece71e7cbd6ee9bde
lists.apache.org/thread/qkmsos3s8chn5053qr466rzwv6sk5gjg
nvd.nist.gov/vuln/detail/CVE-2026-78437

Code Behaviors & Features

Detect and mitigate CVE-2026-78437 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →