An allocation leak in Apache Tomcat’s HTTP/2 backlog tracking causes uncontrolled consumption of system resources when streams are reset, resulting in a denial‑of‑service condition. The flaw is catalogued as CWE‑400 and CWE‑770 and can potentially force a container or host to become unresponsive due to exhausted memory or thread pools.

The vulnerability affects Apache Software Foundation’s Apache Tomcat. It is present in Tomcat 11.0.0‑M1 through 11.0.24, 10.1.0‑M1 through 10.1.57, and 9.0.39 through 9.0.120. Versions 8.5.59 to 8.5.100 are also known to be affected, and other unsupported versions may be impacted as well.

The EPSS score is less than 1%, indicating a very low but nonzero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 7.5, indicating a high severity. Based on the description, it is inferred that the likely attack vector is sending crafted HTTP/2 requests that trigger a stream reset, which can cause the resource leak. The inherent nature of the flaw suggests a high potential impact, as an external attacker can trigger the leak by sending crafted HTTP/2 requests that cause a stream reset. While no exploitation proof is publicly known, the lack of mitigation in affected releases poses a significant risk to availability for systems exposed to HTTP/2 traffic.