CVE-2026-41293 — Vulnerability in org.apache.tomcat:tomcat-coyote...
CRITICAL
Apache Tomcat - HTTP/2 request headers not validated
Published May 12, 2026Updated September 10, 2026Source: osv
Summary
Versions Affected:
Apache Tomcat 11.0.0-M1 to 11.0.21
Apache Tomcat 10.1.0-M1 to 10.1.54
Apache Tomcat 9.0.0.M1 to 9.0.117
Older, unsupported versions may also be affected
Description:
HTTP/2 request headers were not validated which may have triggered
unexpected application behaviour if the application (quite reasonably)
assumed that header value exposed through the Servlet API would be
specification compliant.
Mitigation:
Users of the affected versions should apply one of the following
mitigations:
- Upgrade to Apache Tomcat 11.0.22 or later
- Upgrade to Apache Tomcat 10.1.55 or later
- Upgrade to Apache Tomcat 9.0.118 or later
Credit:
This issue was identified by Dawit Jeong (@dawitngoliath)
Advisory Timeline
- First published May 12, 2026 (153 days ago).
- Last revised September 10, 2026 — 120 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
Maven
Update org.apache.tomcat:tomcat-coyote to 11.0.22 or later<!-- Update pom.xml dependency version to 11.0.22 for org.apache.tomcat:tomcat-coyote -->
Maven
Update org.apache.tomcat:tomcat-coyote to 9.0.118 or later<!-- Update pom.xml dependency version to 9.0.118 for org.apache.tomcat:tomcat-coyote -->
Maven
Update org.apache.tomcat.embed:tomcat-embed-core to 11.0.22 or later<!-- Update pom.xml dependency version to 11.0.22 for org.apache.tomcat.embed:tomcat-embed-core -->
Maven
Update org.apache.tomcat.embed:tomcat-embed-core to 9.0.118 or later<!-- Update pom.xml dependency version to 9.0.118 for org.apache.tomcat.embed:tomcat-embed-core -->
Maven
Update org.apache.tomcat.embed:tomcat-embed-core to 10.1.55 or later<!-- Update pom.xml dependency version to 10.1.55 for org.apache.tomcat.embed:tomcat-embed-core -->
Maven
Update org.apache.tomcat:tomcat to 11.0.22 or later<!-- Update pom.xml dependency version to 11.0.22 for org.apache.tomcat:tomcat -->
Maven
Update org.apache.tomcat:tomcat to 9.0.118 or later<!-- Update pom.xml dependency version to 9.0.118 for org.apache.tomcat:tomcat -->
Maven
Update org.apache.tomcat:tomcat to 10.1.55 or later<!-- Update pom.xml dependency version to 10.1.55 for org.apache.tomcat:tomcat -->
Maven
Update org.apache.tomcat:tomcat-coyote to 10.1.55 or later<!-- Update pom.xml dependency version to 10.1.55 for org.apache.tomcat:tomcat-coyote -->
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (9)
Affects 1 ecosystem: maven (3).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| org.apache.tomcat:tomcat-coyote | maven | 11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+38 more) | 11.0.22 |
| org.apache.tomcat:tomcat-coyote | maven | 8.5.0, 8.5.100, 8.5.11, 8.5.12 (+197 more) | 9.0.118 |
| org.apache.tomcat.embed:tomcat-embed-core | maven | 11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+38 more) | 11.0.22 |
| org.apache.tomcat.embed:tomcat-embed-core | maven | 8.5.0, 8.5.100, 8.5.11, 8.5.12 (+197 more) | 9.0.118 |
| org.apache.tomcat.embed:tomcat-embed-core | maven | 10.1.0, 10.1.0-M1, 10.1.0-M10, 10.1.0-M11 (+57 more) | 10.1.55 |
| org.apache.tomcat:tomcat | maven | 11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+38 more) | 11.0.22 |
| org.apache.tomcat:tomcat | maven | 8.5.0, 8.5.100, 8.5.11, 8.5.12 (+197 more) | 9.0.118 |
| org.apache.tomcat:tomcat | maven | 10.1.0, 10.1.0-M1, 10.1.0-M10, 10.1.0-M11 (+57 more) | 10.1.55 |
| org.apache.tomcat:tomcat-coyote | maven | 10.1.0, 10.1.0-M1, 10.1.0-M10, 10.1.0-M11 (+57 more) | 10.1.55 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-20Improper Input ValidationMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-41293ADVISORY
- https://github.com/apache/tomcat/commit/19f17a257797e8d139b33ff9c88d362a273be148WEB
- https://github.com/apache/tomcat/commit/1c70480466572c9192ed412ebefcd43fc63137fdWEB
- https://github.com/apache/tomcat/commit/2a2476460e823789f530a22207873ea8cd6eff3bWEB
- https://github.com/apache/tomcat/commit/3915fd27e6810b14ccd21e3d900bd8faef44d3dfWEB
- https://github.com/apache/tomcat/commit/57c2b3bfd62792631e1df24cf4237b990a0b36faWEB
- https://github.com/apache/tomcat/commit/c2925554c677da57390f940d856871e18daaacabWEB
- https://github.com/apache/tomcat/commit/cf9452443bcbf3b1a4b435ef7d624364f1b65ca3WEB
- https://github.com/apache/tomcat/commit/e5cef9618c3f4fd31bd6fb1e83f0f18022280dacWEB
- https://github.com/apache/tomcat/commit/f72a6174ab1f0f5a053435f80448b4f6837fe6d7WEB
- https://github.com/apache/tomcatPACKAGE
- https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1rWEB
- https://tomcat.apache.org/security-10.htmlWEB
- https://tomcat.apache.org/security-11.htmlWEB
- https://tomcat.apache.org/security-9.htmlWEB
- https://www.openwall.com/lists/oss-security/2026/05/12/13WEB
Frequently Asked Questions
- What is CVE-2026-41293?
- Apache Tomcat - HTTP/2 request headers not validated This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
- How do I check if my project is affected by CVE-2026-41293?
- CVE-2026-41293 affects org.apache.tomcat:tomcat-coyote, org.apache.tomcat.embed:tomcat-embed-core and org.apache.tomcat:tomcat. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-41293 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
9.8
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
GHSA-r29c-68gh-xp6x
BIT-tomcat-2026-41293
Related CVEs
- CVE-2017-5651CRITICAL
Expected Behavior Violation in Apache Tomcat
- CVE-2025-53506HIGH
Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams
- CVE-2026-24880HIGH
Apache Tomcat has an HTTP Request/Response Smuggling vulnerability
- CVE-2026-29129HIGH
Apache Tomcat: Configured cipher preference order not preserved
- CVE-2024-38286HIGH
Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability
- CVE-2026-24734HIGH
Apache Tomcat has an Improper Input Validation vulnerability
- CVE-2025-66614MEDIUM
Apache Tomcat - Client certificate verification bypass
- CVE-2023-44487MEDIUM
HTTP/2 Stream Cancellation Attack
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies