CVE-2026-41293: Apache Tomcat HTTP/2 Request Headers Validation Flaw
Summary
CVE-2026-41293: Apache Tomcat: HTTP/2 request headers not validated. Affects tomcat across 3 version ranges.
>= 9.0.0.M1, < 9.0.118
>= 10.0.0, < 10.1.55
>= 11.0.0, < 11.0.22
Fixed in 9.0.118, 10.1.55 or 11.0.22, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2026-41293 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used to deploy Java applications and provides a robust environment for running web applications. However, certain versions of Tomcat have been found to have a vulnerability related to improper validation of HTTP/2 request headers, which could potentially allow attackers to exploit this flaw.
Vulnerability Detail
The vulnerability identified as CVE-2026-41293 stems from improper input validation in Apache Tomcat affecting versions 11.0.0 through 11.0.21, 10.1.0 through 10.1.54, 9.0.0.M1 through 9.0.117, and 10.0.0 through 10.0.27. This flaw can lead to various security issues, including denial of service or unauthorized access, as attackers may manipulate HTTP/2 request headers to bypass security controls.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 9.0.0.M1, < 9.0.1189.0.118 -
>= 10.0.0, < 10.1.5510.1.55 -
>= 11.0.0, < 11.0.2211.0.22
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable HTTP/2 support in their Tomcat configuration until they can upgrade to a secure version. This can be done by modifying the server.xml file and removing or commenting out the HTTP/2 connector configuration.
Conclusion
In summary, CVE-2026-41293 represents a significant security vulnerability in various versions of Apache Tomcat due to improper validation of HTTP/2 request headers. Users are strongly encouraged to upgrade to the fixed versions to mitigate potential risks.
See every vulnerability recorded for tomcat →
FAQ
CVE-2026-41293 is a vulnerability in Apache Tomcat related to improper validation of HTTP/2 request headers.
Affected versions include Apache Tomcat 11.0.0 through 11.0.21, 10.1.0 through 10.1.54, 9.0.0.M1 through 9.0.117, and 10.0.0 through 10.0.27.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include denial of service attacks and unauthorized access to sensitive information due to the improper validation of request headers.
You can upgrade your Tomcat installation by downloading the latest version from the official Apache Tomcat website or using a package manager with the appropriate command.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat.
