Critical severity9.1NVD Advisory· Published Sep 23, 2026· Updated Sep 23, 2026
CVE-2026-86350
CVE-2026-86350
Description
Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up.
This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121.
Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Affected products
10- osv-coords9 versionspkg:bitnami/tomcatpkg:rpm/opensuse/libtcnative-1-0&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/libtcnative-2-0&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/tomcat&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/tomcat&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/tomcat10&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/tomcat10&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/tomcat11&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/tomcat11&distro=openSUSE%20Tumbleweed
>= 9.0.118, < 9.0.122+ 8 more
- (no CPE)range: >= 9.0.118, < 9.0.122
- (no CPE)range: < 1.3.9-160000.1.1
- (no CPE)range: < 2.0.16-160000.1.1
- (no CPE)range: < 9.0.122-160000.1.1
- (no CPE)range: < 9.0.122-1.1
- (no CPE)range: < 10.1.60-160000.1.1
- (no CPE)range: < 10.1.60-1.1
- (no CPE)range: < 11.0.26-160000.1.1
- (no CPE)range: < 11.0.26-1.1
Patches
Vulnerability mechanics
References
1News mentions
4- ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware ArrestsThe Hacker News · Oct 5, 2026
- Apache: 25 Vulnerabilities Disclosed, Critical Flaws Hit Tomcat on Sep 23-24, 2026Vypr Intelligence · Sep 24, 2026
- Apache Tomcat Update Fixes WebSocket and HTTP/2 Flaws Affecting Server SecurityCyber Security News · Sep 24, 2026
- Apache Tomcat: 12 Vulnerabilities Including HTTP/2 Smuggling and Auth Bypass Disclosed TogetherVypr Intelligence · Sep 23, 2026