CVE-2026-86350: Apache Tomcat Request Header Mix-Up Vulnerability
Summary
CVE-2026-86350: Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up. Affects tomcat across 3 version ranges.
>= 9.0.118, < 9.0.122
>= 10.1.55, < 10.1.60
>= 11.0.22, < 11.0.26
Fixed in 9.0.122, 10.1.60 or 11.0.26, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java applications and provides a robust environment for web applications. The package is known for its scalability, performance, and support for the latest Java standards. However, it has recently been found to be vulnerable to a regression issue that can lead to request header mix-ups, impacting the integrity of HTTP/2 requests.
Vulnerability Detail
The vulnerability arises from a regression in the fix for CVE-2026-41293, which leads to inconsistent interpretation of HTTP/2 requests, also known as HTTP Request/Response smuggling. This flaw can allow an attacker to manipulate request headers, potentially leading to unauthorized access or data leakage. The affected versions of Apache Tomcat include 11.0.22 through 11.0.25, 10.1.55 through 10.1.59, and 9.0.118 through 9.0.121.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 9.0.118, < 9.0.1229.0.122 -
>= 10.1.55, < 10.1.6010.1.60 -
>= 11.0.22, < 11.0.2611.0.26
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users may consider disabling HTTP/2 support in their Tomcat configuration until they can apply the necessary updates. This can be done by modifying the server configuration file (server.xml) to remove or comment out the HTTP/2 connector settings.
Conclusion
The CVE-2026-86350 vulnerability in Apache Tomcat poses a significant risk due to its potential for request header manipulation. Users are strongly advised to upgrade to the latest patched versions to mitigate this risk. Additionally, temporary workarounds can be implemented while awaiting updates.
See every vulnerability recorded for tomcat →
FAQ
CVE-2026-86350 is a vulnerability in Apache Tomcat that can lead to request header mix-ups due to a regression in a previous fix.
The affected versions include Apache Tomcat 11.0.22 to 11.0.25, 10.1.55 to 10.1.59, and 9.0.118 to 9.0.121.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without requiring signup.
Exploitation of this vulnerability can lead to unauthorized access, data leakage, or other security breaches due to manipulated request headers.
You can upgrade your Tomcat installation by downloading the latest version from the official website or using a package manager. For example, use sudo apt-get install tomcat=11.0.26 to update to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for tomcat.
