CVE Intelligence
Analysis AI-assisted

CVE-2026-41293: Apache Tomcat: HTTP/2 request headers not validated

CVE-2026-41293 is an improper input validation weakness (CWE-20) in Apache Tomcat affecting how HTTP/2 request headers are handled. The CNA and CISA ADP both assign a CVSS base score of 9.8 (critical), and the affected ranges span several release lines. The record does not contain a resolved fixed version and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The record describes an improper input validation weakness (CWE-20) in Apache Tomcat related to HTTP/2 request headers. The CNA and the CISA ADP both record a CVSS base score of 9.8. The record does not explain the exact mechanics of the flaw, and this analysis does not attempt to add them.

Impact

  • Improper input validation can cause untrusted request data to be processed in ways the server does not expect.
  • The scoring in the record indicates high impact to confidentiality, integrity and availability, with no privileges or user interaction required from a remote attacker.
  • The SSVC fields in the record list technical impact as total and automatable as yes. These are scoring-model outputs, not observed attacks.

Affected products and versions

The advisory text names these ranges for Apache Software Foundation Tomcat:

  • from 11.0.0-M1 through 11.0.21
  • from 10.1.0-M1 through 10.1.54
  • from 9.0.0.M1 through 9.0.117
  • from 10.0.0-M1 through 10.0.27

The advisory also states that older, end-of-support versions may be affected. The structured range data is broader and includes 8.5.0 through 8.5.100, plus ranges that end before 9.0.118, before 10.1.55 and before 11.0.22. The record does not state which of these bounds are the fixed releases.

Exploitation status

  • The KEV catalog entry in the record is not listed.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • The EPSS probability in the record is 0.0168 with a percentile of 0.76776. These are predictive estimates, not evidence of attacks.

Remediation and mitigation

  • Review the Apache advisory linked below and identify the fixed release for each release line you run.
  • Upgrade affected Tomcat installations to a supported release that the vendor lists as fixed. Do not rely on the placeholder text in the advisory description.
  • Retire end-of-support Tomcat branches, since the advisory notes they may also be affected.
  • Where patching is delayed, reduce exposure of HTTP/2-enabled connectors to untrusted networks and review whether a reverse proxy or load balancer normalizes incoming headers.

Detection guidance

  • Maintain an inventory of Tomcat versions and whether HTTP/2 is enabled on each connector.
  • Monitor for malformed or unusual HTTP/2 request patterns and for error spikes at the application or proxy layer.
  • Correlate such alerts with asset inventory to prioritize internet-facing servers.

Limitations of the available information

  • The record's description contains an unresolved placeholder instead of a fixed version number, and the fixes list is empty.
  • The structured range endpoints of 9.0.118, 10.1.55 and 11.0.22 are consistent with the next releases on each line, but the record does not confirm them as fixes.
  • The record does not describe the attack path, the required conditions or the observed consequences beyond the scoring vector and CWE.
  • Exploitation status is based only on the KEV and SSVC fields and the sources consulted.

Frequently asked questions

Is CVE-2026-41293 being actively exploited?

The record shows the vulnerability is not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. The EPSS probability in the record is 0.0168.

Which Apache Tomcat versions are affected?

The advisory names from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117 and from 10.0.0-M1 through 10.0.27, and says older end-of-support versions may also be affected.

What version should I upgrade to?

The record does not confirm a fixed version because the advisory text contains an unresolved placeholder and the fixes list is empty. Check the Apache mailing list advisory and use the fixed release it names for your release line.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.