CVE-2026-86350 — Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up

Description (CNA)

Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Tomcat	affected 11.0.22 through 11.0.25; affected 10.1.55 through 10.1.59; affected 9.0.118 through 9.0.121

CWE

CWE-444

References

https://lists.apache.org/thread/mss45z99lcdd5dtpgcn45dy82f3toswc

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.