CVE-2026-68763: Uncontrolled Resource Consumption

August 25, 2026 (updated August 27, 2026)

Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120.

The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

References

lists.apache.org/thread/tv51ty39ppv41v04hdtkp9dp7tg02nzl
nvd.nist.gov/vuln/detail/CVE-2026-68763

Code Behaviors & Features

Detect and mitigate CVE-2026-68763 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →