Database Management

Why SolarWinds Database Performance Analyzer (DPA) is at low risk for CVE-2026-77756

This article explains why SolarWinds Database Performance Analyzer (DPA) is at low risk for CVE-2026-77756.

First published date

10/22/2026 12:46 PM

Last published date

10/22/2026 12:46 PM

Overview

In 2026, the National Institute of Standards and Technology (NIST) published a security bulletin about CVE-2026-77756.

Product section

Database Performance Analyzer

Cause

CVE-2026-77756 is an inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy.

Resolution

SolarWinds Database Performance Analyzer (DPA) is at low risk for CVE-2026-77756.

The vulnerability is only possible if all the following conditions are met:

  • DPA is running behind the reverse proxy, API gateway or load balancer  
  • If front-end component (reverse proxy, load balancer, API gateway) parses HTTP request framing differently than Tomcat does.  

SolarWinds DPA is at a lower risk because it should be running in a trusted network, as per the DPA Secure Configuration Guide: Best Practices and Recommendations.

The worst-case scenario for CVE-2026-77756 on DPA would be causing another client's in-flight request to fail.  

While the component’s presence is flagged by dependency scanning tools, our analysis shows there is no associated security risk. We are tracking this dependency and plan to remove or upgrade it in a future release to fully eliminate the finding.