GHSA-r29c-68gh-xp6x
Apache Tomcat - HTTP/2 request headers not validated
At a glance
- Published
- Updated
- CVE
- CVE-2026-41293
- Aliases
- BIT-tomcat-2026-41293
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache Tomcat 9.0.0.M1 to 9.0.117 Older, unsupported versions may also be affected Description: HTTP/2 request headers were not validated which may have triggered unexpected application behaviour if the application (quite reasonably) assumed that header value exposed through the Servlet API would be specification compliant. Mitigation: Users of the affected versions should apply one of the following mitigations: - Upgrade to Apache Tomcat 11.0.22 or later - Upgrade to Apache Tomcat 10.1.55 or later - Upgrade to Apache Tomcat 9.0.118 or later Credit: This issue was identified by Dawit Jeong (@dawitngoliath)
Affected packages
| Package | Versions |
|---|---|
| Maven · org.apache.tomcat.embed:tomcat-embed-core | introduced 8.5.0, fixed 9.0.118 |
| Maven · org.apache.tomcat.embed:tomcat-embed-core | introduced 10.1.0-M1, fixed 10.1.55 |
| Maven · org.apache.tomcat.embed:tomcat-embed-core | introduced 11.0.0-M1, fixed 11.0.22 |
| Maven · org.apache.tomcat:tomcat | introduced 8.5.0, fixed 9.0.118 |
| Maven · org.apache.tomcat:tomcat | introduced 10.1.0-M1, fixed 10.1.55 |
| Maven · org.apache.tomcat:tomcat | introduced 11.0.0-M1, fixed 11.0.22 |
| Maven · org.apache.tomcat:tomcat-coyote | introduced 8.5.0, fixed 9.0.118 |
| Maven · org.apache.tomcat:tomcat-coyote | introduced 10.1.0-M1, fixed 10.1.55 |
| Maven · org.apache.tomcat:tomcat-coyote | introduced 11.0.0-M1, fixed 11.0.22 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-41293 ADVISORY
- https://github.com/apache/tomcat/commit/19f17a257797e8d139b33ff9c88d362a273be148 WEB
- https://github.com/apache/tomcat/commit/1c70480466572c9192ed412ebefcd43fc63137fd WEB
- https://github.com/apache/tomcat/commit/2a2476460e823789f530a22207873ea8cd6eff3b WEB
- https://github.com/apache/tomcat/commit/3915fd27e6810b14ccd21e3d900bd8faef44d3df WEB
- https://github.com/apache/tomcat/commit/57c2b3bfd62792631e1df24cf4237b990a0b36fa WEB
- https://github.com/apache/tomcat/commit/c2925554c677da57390f940d856871e18daaacab WEB
- https://github.com/apache/tomcat/commit/cf9452443bcbf3b1a4b435ef7d624364f1b65ca3 WEB
- https://github.com/apache/tomcat/commit/e5cef9618c3f4fd31bd6fb1e83f0f18022280dac WEB
- https://github.com/apache/tomcat/commit/f72a6174ab1f0f5a053435f80448b4f6837fe6d7 WEB
- https://github.com/apache/tomcat PACKAGE
- https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r WEB
- https://tomcat.apache.org/security-10.html WEB
- https://tomcat.apache.org/security-11.html WEB
- https://tomcat.apache.org/security-9.html WEB
- http://www.openwall.com/lists/oss-security/2026/05/12/13 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |