CVE-2026-86350

Apache Tomcat versions 9.0.118–9.0.121, 10.1.55–10.1.59 and 11.0.22–11.0.25 contain an HTTP/2 request-smuggling flaw introduced by a regression in the fix for CVE-2026-41293. A crafted HTTP/2 request is parsed inconsistently, allowing request headers to be mixed up between requests. In a proxy-fronted deployment, an attacker can exploit this desynchronization to smuggle headers into another user's request, which can lead to header-based authorization bypass, session or identity confusion, or cache poisoning. Only deployments with HTTP/2 enabled on the affected patch levels are exposed, and no public proof of concept or active exploitation is currently known.

What to do: Upgrade to Apache Tomcat 11.0.26, 10.1.60, or 9.0.122 depending on your branch. If you cannot upgrade immediately, consider disabling the HTTP/2 connector (revert to HTTP/1.1) or ensure Tomcat is only reachable through a trusted reverse proxy. Review access logs for anomalous or duplicated headers on HTTP/2 traffic that could indicate smuggling attempts, and verify that any proxy-injected identity or authorization headers cannot be influenced by client requests.