CVE-2026-86350: Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up

Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Apache Tomcat versions 9.0.118–9.0.121, 10.1.55–10.1.59 and 11.0.22–11.0.25 contain an HTTP/2 request-smuggling flaw introduced by a regression in the fix for CVE-2026-41293. A crafted HTTP/2 request is parsed inconsistently, allowing request headers to be mixed up between requests. In a proxy-fronted deployment, an attacker can exploit this desynchronization to smuggle headers into another user's request, which can lead to header-based authorization bypass, session or identity confusion, or cache poisoning. Only deployments with HTTP/2 enabled on the affected patch levels are exposed, and no public proof of concept or active exploitation is currently known.

Do: Upgrade to Apache Tomcat 11.0.26, 10.1.60, or 9.0.122 depending on your branch. If you cannot upgrade immediately, consider disabling the HTTP/2 connector (revert to HTTP/1.1) or ensure Tomcat is only reachable through a trusted reverse proxy. Review access logs for anomalous or duplicated headers on HTTP/2 traffic that could indicate smuggling attempts, and verify that any proxy-injected identity or authorization headers cannot be influenced by client requests.