High severity7.3NVD Advisory· Published May 12, 2026· Updated May 14, 2026
CVE-2026-42498
CVE-2026-42498
Description
Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, from 7.0.83 through 7.0.109.
Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118, which fix the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.tomcat.embed:tomcat-embed-coreMaven | < 9.0.118 | 9.0.118 |
org.apache.tomcat.embed:tomcat-embed-coreMaven | >= 10.1.0-M1, < 10.1.55 | 10.1.55 |
org.apache.tomcat.embed:tomcat-embed-coreMaven | >= 11.0.0-M1, < 11.0.22 | 11.0.22 |
org.apache.tomcat:tomcatMaven | < 9.0.118 | 9.0.118 |
org.apache.tomcat:tomcatMaven | >= 10.1.0-M1, < 10.1.55 | 10.1.55 |
org.apache.tomcat:tomcatMaven | >= 11.0.0-M1, < 11.0.22 | 11.0.22 |
org.apache.tomcat:tomcat-catalinaMaven | < 9.0.118 | 9.0.118 |
org.apache.tomcat:tomcat-catalinaMaven | >= 10.1.0-M1, < 10.1.55 | 10.1.55 |
org.apache.tomcat:tomcat-catalinaMaven | >= 11.0.0-M1, < 11.0.22 | 11.0.22 |
Affected products
39- osv-coords38 versionspkg:apk/chainguard/camunda-8.8pkg:apk/chainguard/camunda-8.9pkg:apk/chainguard/camunda-zeebe-8.7pkg:apk/chainguard/camunda-zeebe-8.8pkg:apk/chainguard/camunda-zeebe-8.9pkg:apk/chainguard/kayenta-2025.4pkg:apk/chainguard/kayenta-2026.0pkg:apk/chainguard/kayenta-2026.1pkg:apk/chainguard/kayenta-fips-2025.4pkg:apk/chainguard/kayenta-fips-2026.0pkg:apk/chainguard/kayenta-fips-2026.1pkg:apk/chainguard/nacospkg:apk/chainguard/ontoppkg:apk/chainguard/ontop-fipspkg:apk/chainguard/thingsboard-tb-mqtt-transportpkg:apk/chainguard/thingsboard-tb-nodepkg:apk/wolfi/thingsboard-tb-mqtt-transportpkg:apk/wolfi/thingsboard-tb-nodepkg:bitnami/tomcatpkg:rpm/opensuse/tomcat10&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/tomcat11&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/tomcat&distro=openSUSE%20Tumbleweedpkg:rpm/suse/tomcat10&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOSpkg:rpm/suse/tomcat10&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSSpkg:rpm/suse/tomcat10&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP7pkg:rpm/suse/tomcat10&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSSpkg:rpm/suse/tomcat10&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSSpkg:rpm/suse/tomcat10&distro=SUSE%20Linux%20Enterprise%20Server%2016.0pkg:rpm/suse/tomcat10&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5pkg:rpm/suse/tomcat10&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6pkg:rpm/suse/tomcat10&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0pkg:rpm/suse/tomcat11&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP7pkg:rpm/suse/tomcat11&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSSpkg:rpm/suse/tomcat11&distro=SUSE%20Linux%20Enterprise%20Server%2016.0pkg:rpm/suse/tomcat11&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6pkg:rpm/suse/tomcat11&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2016.0pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0
< 8.8.24-r2+ 37 more
- (no CPE)range: < 8.8.24-r2
- (no CPE)range: < 8.9.5-r2
- (no CPE)range: < 8.7.29-r1
- (no CPE)range: < 8.8.24-r1
- (no CPE)range: < 8.9.5-r2
- (no CPE)range: < 2025.4.3-r8
- (no CPE)range: < 2026.0.2-r8
- (no CPE)range: < 2026.1.0-r1
- (no CPE)range: < 2025.4.3-r9
- (no CPE)range: < 2026.0.2-r9
- (no CPE)range: < 2026.1.0-r1
- (no CPE)range: < 3.2.1-r3
- (no CPE)range: < 5.5.0-r9
- (no CPE)range: < 5.5.0-r5
- (no CPE)range: < 4.3.1.2-r0
- (no CPE)range: < 4.3.1.2-r0
- (no CPE)range: < 4.3.1.2-r0
- (no CPE)range: < 4.3.1.2-r0
- (no CPE)range: >= 10.0.0, < 10.1.55
- (no CPE)range: < 10.1.55-1.1
- (no CPE)range: < 11.0.22-1.1
- (no CPE)range: < 9.0.118-1.1
- (no CPE)range: < 10.1.55-150200.5.67.1
- (no CPE)range: < 10.1.55-150200.5.67.1
- (no CPE)range: < 10.1.55-150200.5.67.1
- (no CPE)range: < 10.1.55-150200.5.67.1
- (no CPE)range: < 10.1.55-150200.5.67.1
- (no CPE)range: < 10.1.55-160000.1.1
- (no CPE)range: < 10.1.55-150200.5.67.1
- (no CPE)range: < 10.1.55-150200.5.67.1
- (no CPE)range: < 10.1.55-160000.1.1
- (no CPE)range: < 11.0.22-150600.13.21.1
- (no CPE)range: < 11.0.22-150600.13.21.1
- (no CPE)range: < 11.0.22-160000.1.1
- (no CPE)range: < 11.0.22-150600.13.21.1
- (no CPE)range: < 11.0.22-160000.1.1
- (no CPE)range: < 9.0.118-160000.1.1
- (no CPE)range: < 9.0.118-160000.1.1
Patches
Vulnerability mechanics
References
10- www.openwall.com/lists/oss-security/2026/05/12/14nvdMailing ListThird Party AdvisoryWEB
- github.com/advisories/GHSA-fv25-8xcx-gqjcghsaADVISORY
- lists.apache.org/thread/n61zwf75jrv09rz90j4jssncm244bwdbnvdMailing ListVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-42498ghsaADVISORY
- github.com/apache/tomcat/commit/169d725788ea6aec217ecac70fe4161c837ba423ghsaWEB
- github.com/apache/tomcat/commit/6cbe274592ef2d11607b5b188e1df649de52f8d5ghsaWEB
- github.com/apache/tomcat/commit/b7b173694d588ddcfa432f079baf763cbbbaa5c4ghsaWEB
- tomcat.apache.org/security-10.htmlghsaWEB
- tomcat.apache.org/security-11.htmlghsaWEB
- tomcat.apache.org/security-9.htmlghsaWEB
News mentions
0No linked articles in our index yet.