CVE-2026-41293: Apache Tomcat HTTP/2 Request Header Validation Flaw
Summary
CVE-2026-41293: Apache Tomcat - HTTP/2 request headers not validated. Affects org.apache.tomcat.embed:tomcat-embed-core across 3 version ranges.
< 9.0.118
>= 10.1.0-M1, < 10.1.55
>= 11.0.0-M1, < 11.0.22
Fixed in 9.0.118, 10.1.55 or 11.0.22, depending on the release line you run. How to fix ↓
Also tracked for
- tomcat · Bitnami
The same CVE-2026-41293 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is a widely used open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It serves as a web server and servlet container, allowing developers to run Java applications on the web. The affected versions of Tomcat (9.0.0.M1 to 9.0.117, 10.1.0-M1 to 10.1.54, and 11.0.0-M1 to 11.0.21) have a critical vulnerability related to the validation of HTTP/2 request headers, which can lead to unexpected application behavior.
Vulnerability Detail
The vulnerability arises from the lack of validation for HTTP/2 request headers in Apache Tomcat. This oversight can result in applications behaving unexpectedly, especially if they assume that header values exposed through the Servlet API comply with the HTTP/2 specification. Attackers could exploit this flaw to manipulate application behavior, potentially leading to unauthorized access or data exposure.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 9.0.1189.0.118 -
>= 10.1.0-M1, < 10.1.5510.1.55 -
>= 11.0.0-M1, < 11.0.2211.0.22
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can implement additional validation checks in their application code to ensure that HTTP/2 request headers conform to expected formats. However, upgrading to a patched version is the recommended solution.
Conclusion
CVE-2026-41293 is a critical vulnerability in Apache Tomcat that affects multiple versions due to improper validation of HTTP/2 request headers. Users are strongly advised to upgrade to the latest patched versions to mitigate potential risks associated with this flaw.
See every vulnerability recorded for org.apache.tomcat.embed:tomcat-embed-core →
FAQ
CVE-2026-41293 is a critical vulnerability in Apache Tomcat related to the lack of validation for HTTP/2 request headers.
Affected versions include Apache Tomcat 11.0.0-M1 to 11.0.21, 10.1.0-M1 to 10.1.54, and 9.0.0.M1 to 9.0.117.
The vulnerability can lead to unexpected application behavior, unauthorized access, or data exposure due to unvalidated HTTP/2 request headers.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The CVSS score for CVE-2026-41293 is 9.8, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat.embed:tomcat-embed-core.
