# CVE-2026-77762

Race condition in Apache Tomcat HTTP/2 allows trailer injection across requests.

- Page: https://www.vulneraibility.com/cve/CVE-2026-77762
- CVSS: 8.1
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.46% (percentile 40.5)
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-09-23)
- Weakness: CWE-362
- Published: 2026-09-23

## Affected versions

- Apache Software Foundation Apache Tomcat: affected >= 11.0.0-M1 and <= 11.0.25; >= 10.1.0-M1 and <= 10.1.59; >= 9.0.39 and <= 9.0.121; >= 8.56.59 and <= 8.5.100; fixed in <= 7.0.109

A version outside these ranges is not a statement that it is unaffected.

## Impact

HTTP/2 race condition lets attacker inject trailer fields into other requests, enabling request smuggling, header/trailer pollution, auth bypass and potential RCE.

## Action

Immediate action required

## Recommendation

Upgrade to 11.0.26, 10.1.60 or 9.0.122 immediately

## References

- [advisory] https://lists.apache.org/thread/y5r9fvjo7ol24mkoyoc0st8bqrfyqcyn
- [other] http://www.openwall.com/lists/oss-security/2026/09/23/23

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.