AI analysis
Apache Tomcat versions 9.0.118–9.0.121, 10.1.55–10.1.59 and 11.0.22–11.0.25 contain an HTTP/2 request-smuggling flaw introduced by a regression in the fix for CVE-2026-41293. A crafted HTTP/2 request is parsed inconsistently, allowing request headers to be mixed up between requests. In a proxy-fronted deployment, an attacker can exploit this desynchronization to smuggle headers into another user's request, which can lead to header-based authorization bypass, session or identity confusion, or cache poisoning. Only deployments with HTTP/2 enabled on the affected patch levels are exposed, and no public proof of concept or active exploitation is currently known.
What to do: Upgrade to Apache Tomcat 11.0.26, 10.1.60, or 9.0.122 depending on your branch. If you cannot upgrade immediately, consider disabling the HTTP/2 connector (revert to HTTP/1.1) or ensure Tomcat is only reachable through a trusted reverse proxy. Review access logs for anomalous or duplicated headers on HTTP/2 traffic that could indicate smuggling attempts, and verify that any proxy-injected identity or authorization headers cannot be influenced by client requests.
Affected
| Apache Tomcat | 11.0.22 through 11.0.25 |
| Apache Tomcat | 10.1.55 through 10.1.59 |
| Apache Tomcat | 9.0.118 through 9.0.121 |
Estimated exposure
large≈tens of thousands to ~100,000 potentially exposed servers (subset of the ~1M+ internet-visible Tomcat instances running these recent patch levels with HTTP/2… — Public internet scans routinely show over a million exposed Apache Tomcat instances, and the affected ranges cover the then-current stable patch releases that operators who had just patched CVE-2026-41293 would be running, though only…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.