CVE-2026-41293: Apache Tomcat: HTTP/2 request headers not validated

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-12 · updated 2026-10-26
Weakness: CWE-20

Description

Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Summary

Apache Tomcat fails to properly validate HTTP/2 request headers, an improper input validation flaw rated critical (CVSS 9.8). This affects Tomcat 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, 9.0.0.M1 through 9.0.117, and 10.0.0-M1 through 10.0.27; older end-of-support versions may also be affected. There is no evidence of active exploitation (not in CISA KEV, SSVC exploitation: none; EPSS 1.7%). Upgrade to 9.0.118, 10.1.55, or 11.0.22 to remediate.

لا يقوم Apache Tomcat بالتحقق بشكل صحيح من ترويسات طلبات HTTP/2، وهو خلل في التحقق من صحة المدخلات مصنف بالحرج (CVSS 9.8). يؤثر ذلك على Tomcat 11.0.0-M1 حتى 11.0.21، و10.1.0-M1 حتى 10.1.54، و9.0.0.M1 حتى 9.0.117، و10.0.0-M1 حتى 10.0.27؛ وقد تتأثر أيضًا الإصدارات الأقدم المنتهية الدعم. لا توجد أدلة على استغلال نشط (غير مدرج في CISA KEV، وحالة الاستغلال وفق SSVC: لا شيء؛ واحتمال EPSS 1.7%). يُنصح بالترقية إلى 9.0.118 أو 10.1.55 أو 11.0.22 لمعالجة المشكلة.

Affected products

Apache Tomcat: from 8.5.0 through 8.5.100; from 9.0.0 before 9.0.118; from 10.0.0 through 10.0.27; from 10.1.0 before 10.1.55; from 11.0.0 before 11.0.22 — fixed in 9.0.118, 10.1.55, 11.0.22

How to fix

Upgrade to a fixed version: Apache Tomcat 9.0.118, 10.1.55, 11.0.22. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-41293 or the next vulnerability affects your stack