Vulnerabilitymedium
CVE-2026-86350: Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up
AI summary · grok-4.7Summaries by Vani AI
A Tomcat regression of the CVE-2026-41293 fix can mix HTTP/2 request headers.
Apache Tomcat CVE-2026-86350 is an important-severity HTTP/2 request-smuggling flaw caused by a regression in the fix for CVE-2026-41293. Inconsistent interpretation of HTTP/2 requests can mix up request headers. Affected versions are Tomcat 11.0.22 through 11.0.25, 10.1.55 through 10.1.59, and 9.0.118 through 9.0.121. The oss-security post does not say the flaw is being exploited.
Key facts
- Regression affects recent Tomcat 9, 10.1, and 11 releases.
- Apache rates the HTTP/2 header mix-up as important.
- Issue stems from the CVE-2026-41293 fix; exploitation is unreported.
- Vendors
- Apache
- Products
- Apache Tomcat
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-41293 | Improper Input Validation vulnerability in Apache Tomcat | 9.8 | 2% | ||
| CVE-2026-86350 | HTTP/2 Request Smuggling Regression in Apache Tomcat 9, 10.1 and 11 | 9.1 | — |
From the original article
Posted by Mark Thomas on Sep 23 Severity: important Affected versions: - Apache Tomcat 11. 0. 22 through 11.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.