CVE-2026-41293

CVSS 3.1: 9.8 critical
EPSS: 2%p74
Published: May 12, 2026 · May 12, 2026
Modified: Oct 26, 2026

Analyze CVE-2026-41293 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Vendors: apache

Products: tomcat

Weakness: CWE-20

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.6%)

In the news

3 stories

Apache Tomcat 11.0.26 Fixes 12 Security Flaws Enabling WebSocket Bypass and DoS Attacks

Apache Tomcat 11.0.26 patches 12 flaws, including a WebSocket access-control bypass and several DoS bugs.

GBHackersSep 24, 05:33 UTC · Sep 24, 2026VulnerabilityCVE-2026-76183 CVE-2026-87022 CVE-2026-79677+105 · 3 reads

Apache Tomcat Update Fixes WebSocket and HTTP/2 Flaws Affecting Server Security

Apache Tomcat 11.0.26 patches 12 flaws, including WebSocket smuggling and an HTTP/2 header mix-up.

Cyber Security NewsSep 24, 04:04 UTC · Sep 24, 2026VulnerabilityCVE-2026-87022 CVE-2026-86350 CVE-2026-41293+108 · 2 reads

CVE-2026-86350: Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up

A Tomcat regression of the CVE-2026-41293 fix can mix HTTP/2 request headers.

oss-securitySep 23, 16:50 UTC · Sep 23, 2026VulnerabilityCVE-2026-86350 CVE-2026-412934 · 3 reads