Apache Tomcat is vulnerable to a race condition in its HPACK emitter that allows a concurrent request to inject HTTP/2 trailer fields into a different, recycled request. The flaw arises from improper synchronization of a shared request pool. An attacker can manipulate request trailers, which may cause the server to misinterpret request metadata or trigger unintended application behavior. While the CVE does not claim remote code execution, the injection can potentially subvert request handling or leak sensitive data.

Affected versions are Apache Tomcat 10.1.0-M1 through 10.1.59, 9.0.39 through 9.0.121, 8.5.59 through 8.5.100 (EOL), and 11.0.0-M1 through 11.0.25. The vendor has released fixes in Tomcat 11.0.26, 10.1.60, and 9.0.122.

The EPSS score for this vulnerability is 0.00361, indicating a very low probability of exploitation, and it is not listed in the CISA KEV catalog. The likely attack vector is a network‑level attacker sending specially crafted HTTP/2 requests to a Tomcat instance, exploiting the race condition during request processing. Because the flaw manipulates shared request objects, multiple compromised requests could affect several users on the same server, potentially leading to malformed responses or denial of service. Even though the exact impact is limited to trailer manipulation, the possibility of altering request semantics warrants immediate remediation. The CVSS score for this vulnerability is 8.1.