CVE-2026-86350

CVE-2026-86350 · Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

CVSS 9.1 · Critical · EPSS 0.3% · Public exploit · Fix available

Published: 2026-09-23T11:31:36.328Z
Updated: 2026-09-23T16:17:11.408Z

Stack: system

Affected products and versions

apache tomcat
Versions
- ≥ 11.0.22, ≤ 11.0.25: Affected (semver)
- ≥ 10.1.55, ≤ 10.1.59: Affected (semver)
- ≥ 9.0.118, ≤ 9.0.121: Affected (semver)
No fix published
tomcat10 Debian:12
Versions
- 10.1.10-1
- 10.1.13-1
- 10.1.14-1
- 10.1.15-1
- 10.1.16-1
- 10.1.20-1
- 10.1.23-1
- 10.1.25-1
- 10.1.25-1~bpo12+1
- 10.1.25-2
- 10.1.30-1
- 10.1.30-1~bpo12+1
- 10.1.31-1
- 10.1.33-1
- 10.1.33-1~bpo12+1
- 10.1.34-0+deb12u1
- 10.1.34-0+deb12u2
- 10.1.34-1
- 10.1.35-1
- 10.1.40-1
- 10.1.40-1~bpo12+1
- 10.1.46-1
- 10.1.52-1
- 10.1.52-1~deb12u1
- 10.1.52-1~deb13u1
- 10.1.52-2
- 10.1.54-1
- 10.1.55-1
- 10.1.55-1~deb12u1
- 10.1.55-1~deb13u1
- 10.1.6-1
- 10.1.6-1+deb12u1
- 10.1.6-1+deb12u2
- 10.1.60-1
- 10.1.7-1
- 10.1.8-1
- 10.1.9-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat10 Debian:13
Versions
- 10.1.40-1
- 10.1.46-1
- 10.1.52-1
- 10.1.52-1~deb12u1
- 10.1.52-1~deb13u1
- 10.1.52-2
- 10.1.54-1
- 10.1.55-1
- 10.1.55-1~deb12u1
- 10.1.55-1~deb13u1
- 10.1.60-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat10 Debian:14
Versions
- 10.1.40-1
- 10.1.46-1
- 10.1.52-1
- 10.1.52-1~deb12u1
- 10.1.52-1~deb13u1
- 10.1.52-2
- 10.1.54-1
- 10.1.55-1
- 10.1.55-1~deb12u1
- 10.1.55-1~deb13u1
Affected ranges
- ECOSYSTEM: < 10.1.60-1
Update to 10.1.60-1
tomcat11 Debian:13
Versions
- 11.0.11-1
- 11.0.15-1
- 11.0.15-1~deb13u1
- 11.0.18-1
- 11.0.21-1
- 11.0.22-1
- 11.0.22-1~deb13u1
- 11.0.22-2
- 11.0.24-1
- 11.0.6-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat11 Debian:14
Versions
- 11.0.11-1
- 11.0.15-1
- 11.0.15-1~deb13u1
- 11.0.18-1
- 11.0.21-1
- 11.0.22-1
- 11.0.22-1~deb13u1
- 11.0.22-2
- 11.0.24-1
- 11.0.6-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Debian:12
Affected ranges
- ECOSYSTEM: < 9.0.70-2
Update to 9.0.70-2
tomcat9 Debian:13
Affected ranges
- ECOSYSTEM: < 9.0.70-2
Update to 9.0.70-2
tomcat9 Debian:14
Affected ranges
- ECOSYSTEM: < 9.0.70-2
Update to 9.0.70-2
tomcat6 Ubuntu:Pro:14.04:LTS
Versions
- 6.0.37-1
- 6.0.39-1
- 6.0.39-1ubuntu0.1
- 6.0.39-1ubuntu0.1+esm1
- 6.0.39-1ubuntu0.1+esm2
- 6.0.39-1ubuntu0.1+esm3
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat7 Ubuntu:Pro:14.04:LTS
Versions
- 7.0.42-1
- 7.0.47-1
- 7.0.50-1
- 7.0.52-1
- 7.0.52-1ubuntu0.1
- 7.0.52-1ubuntu0.3
- 7.0.52-1ubuntu0.6
- 7.0.52-1ubuntu0.7
- 7.0.52-1ubuntu0.8
- 7.0.52-1ubuntu0.9
- 7.0.52-1ubuntu0.10
- 7.0.52-1ubuntu0.11
- 7.0.52-1ubuntu0.13
- 7.0.52-1ubuntu0.14
- 7.0.52-1ubuntu0.15
- 7.0.52-1ubuntu0.16
- 7.0.52-1ubuntu0.16+esm1
- 7.0.52-1ubuntu0.16+esm2
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat8 Ubuntu:Pro:16.04:LTS
Versions
- 8.0.26-1
- 8.0.28-1
- 8.0.30-1
- 8.0.32-1
- 8.0.32-1ubuntu1
- 8.0.32-1ubuntu1.1
- 8.0.32-1ubuntu1.2
- 8.0.32-1ubuntu1.3
- 8.0.32-1ubuntu1.4
- 8.0.32-1ubuntu1.5
- 8.0.32-1ubuntu1.6
- 8.0.32-1ubuntu1.7
- 8.0.32-1ubuntu1.8
- 8.0.32-1ubuntu1.9
- 8.0.32-1ubuntu1.10
- 8.0.32-1ubuntu1.11
- 8.0.32-1ubuntu1.13
- 8.0.32-1ubuntu1.13+esm1
- 8.0.32-1ubuntu1.13+esm2
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat7 Ubuntu:Pro:16.04:LTS
Versions
- 7.0.64-1
- 7.0.68-1
- 7.0.68-1ubuntu0.1
- 7.0.68-1ubuntu0.3
- 7.0.68-1ubuntu0.4
- 7.0.68-1ubuntu0.4+esm1
- 7.0.68-1ubuntu0.4+esm2
- 7.0.68-1ubuntu0.4+esm3
- 7.0.68-1ubuntu0.4+esm4
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat8 Ubuntu:Pro:18.04:LTS
Versions
- 8.5.21-1ubuntu1
- 8.5.29-1
- 8.5.30-1
- 8.5.30-1ubuntu1
- 8.5.30-1ubuntu1.2
- 8.5.30-1ubuntu1.3
- 8.5.30-1ubuntu1.4
- 8.5.39-1ubuntu1~18.04.1
- 8.5.39-1ubuntu1~18.04.2
- 8.5.39-1ubuntu1~18.04.3
- 8.5.39-1ubuntu1~18.04.3+esm1
- 8.5.39-1ubuntu1~18.04.3+esm2
- 8.5.39-1ubuntu1~18.04.3+esm3
- 8.5.39-1ubuntu1~18.04.3+esm4
- 8.5.39-1ubuntu1~18.04.3+esm5
- 8.5.39-1ubuntu1~18.04.3+esm6
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Ubuntu:Pro:18.04:LTS
Versions
- 9.0.16-3~18.04.1
- 9.0.16-3ubuntu0.18.04.1
- 9.0.16-3ubuntu0.18.04.2
- 9.0.16-3ubuntu0.18.04.2+esm1
- 9.0.16-3ubuntu0.18.04.2+esm2
- 9.0.16-3ubuntu0.18.04.2+esm3
- 9.0.16-3ubuntu0.18.04.2+esm4
- 9.0.16-3ubuntu0.18.04.2+esm5
- 9.0.16-3ubuntu0.18.04.2+esm6
- 9.0.16-3ubuntu0.18.04.2+esm7
- 9.0.16-3ubuntu0.18.04.2+esm8
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Ubuntu:Pro:20.04:LTS
Versions
- 9.0.24-1
- 9.0.27-1
- 9.0.31-1
- 9.0.31-1ubuntu0.1
- 9.0.31-1ubuntu0.2
- 9.0.31-1ubuntu0.3
- 9.0.31-1ubuntu0.4
- 9.0.31-1ubuntu0.5
- 9.0.31-1ubuntu0.6
- 9.0.31-1ubuntu0.7
- 9.0.31-1ubuntu0.8
- 9.0.31-1ubuntu0.9
- 9.0.31-1ubuntu0.9+esm1
- 9.0.31-1ubuntu0.9+esm2
- 9.0.31-1ubuntu0.9+esm3
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Ubuntu:Pro:22.04:LTS
Versions
- 9.0.43-3
- 9.0.54-1
- 9.0.55-1
- 9.0.58-1
- 9.0.58-1ubuntu0.1
- 9.0.58-1ubuntu0.1+esm1
- 9.0.58-1ubuntu0.1+esm2
- 9.0.58-1ubuntu0.1+esm3
- 9.0.58-1ubuntu0.1+esm4
- 9.0.58-1ubuntu0.2
- 9.0.58-1ubuntu0.2+esm1
- 9.0.58-1ubuntu0.2+esm2
- 9.0.58-1ubuntu0.2+esm3
- 9.0.58-1ubuntu0.2+esm4
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat10 Ubuntu:24.04:LTS
Versions
- 10.1.10-1
- 10.1.14-1
- 10.1.15-1
- 10.1.16-1
- 10.1.16-1ubuntu0.1~esm1
- 10.1.16-1ubuntu0.1~esm2
- 10.1.16-1ubuntu0.1~esm3
- 10.1.16-1ubuntu0.1~esm4
- 10.1.55-1ubuntu2~24.04.1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Ubuntu:24.04:LTS
Versions
- 9.0.70-1ubuntu1
- 9.0.70-2
- 9.0.70-2ubuntu0.1
- 9.0.70-2ubuntu0.1+esm1
- 9.0.70-2ubuntu0.1+esm2
- 9.0.70-2ubuntu0.1+esm3
- 9.0.118-1~24.04.1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat10 Ubuntu:26.10
Versions
- 10.1.40-1ubuntu1
- 10.1.54-1
- 10.1.54-1ubuntu1
- 10.1.54-1ubuntu2
- 10.1.55-1ubuntu1
- 10.1.55-1ubuntu2
- 10.1.57~us1-0ubuntu1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat11 Ubuntu:26.10
Versions
- 11.0.18-1
- 11.0.22-2
- 11.0.22-2ubuntu1
- 11.0.22-2ubuntu2
- 11.0.24-1ubuntu1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Ubuntu:26.10
Versions
- 9.0.115-1
- 9.0.115-1ubuntu1
- 9.0.118-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat10 Ubuntu:26.04:LTS
Versions
- 10.1.40-1ubuntu1
- 10.1.40-1ubuntu1.26.04.1
- 10.1.55-1ubuntu2~26.04.1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Ubuntu:26.04:LTS
Versions
- 9.0.95-1ubuntu1
- 9.0.111-1
- 9.0.115-1
- 9.0.115-1ubuntu0.1
- 9.0.118-1~26.04.1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published

Original sources

Check your server →

CVE-2026-86350 · Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up

Affected products and versions

apache tomcat

tomcat10 Debian:12

tomcat10 Debian:13

tomcat10 Debian:14

tomcat11 Debian:13

tomcat11 Debian:14

tomcat9 Debian:12

tomcat9 Debian:13

tomcat9 Debian:14

tomcat6 Ubuntu:Pro:14.04:LTS

tomcat7 Ubuntu:Pro:14.04:LTS

tomcat8 Ubuntu:Pro:16.04:LTS

tomcat7 Ubuntu:Pro:16.04:LTS

tomcat8 Ubuntu:Pro:18.04:LTS

tomcat9 Ubuntu:Pro:18.04:LTS

tomcat9 Ubuntu:Pro:20.04:LTS

tomcat9 Ubuntu:Pro:22.04:LTS

tomcat10 Ubuntu:24.04:LTS

tomcat9 Ubuntu:24.04:LTS

tomcat10 Ubuntu:26.10

tomcat11 Ubuntu:26.10

tomcat9 Ubuntu:26.10

tomcat10 Ubuntu:26.04:LTS

tomcat9 Ubuntu:26.04:LTS

Original sources