CVE-2026-68763

A flaw was found in Apache Tomcat. This vulnerability, an uncontrolled resource consumption issue, arises from an allocation leak in the HTTP/2 backlog tracking when a stream is reset. A remote attacker could exploit this to cause a Denial of Service (DoS), making the server unresponsive or unavailable to users.

This Important flaw in Apache Tomcat, as shipped with Red Hat JBoss Web Server, allows a remote, unauthenticated attacker to cause a denial of service. The vulnerability stems from an allocation leak in the HTTP/2 backlog tracking, which can be triggered by resetting an HTTP/2 stream, leading to resource exhaustion and service unavailability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, disable the HTTP/2 protocol in Apache Tomcat if it is not required for your deployment. This can be achieved by commenting out or removing the <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" /> element within the <Connector> configuration in the server.xml file. After modifying server.xml, a restart of the Apache Tomcat service is required for the changes to take effect.