CVE-2026-86350

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-86350", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-09-07T09:49:48.382Z", "datePublished": "2026-09-23T11:31:36.328Z", "dateUpdated": "2026-09-23T16:17:11.408Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-09-23T11:31:36.328Z"}, "title": "Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up", "problemTypes": [{"descriptions": [{"description": "CWE-444 Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling')", "lang": "en", "cweId": "CWE-444", "type": "CWE"}]}], "source": {"discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Tomcat", "versions": [{"status": "affected", "version": "11.0.22", "lessThanOrEqual": "11.0.25", "versionType": "semver"}, {"status": "affected", "version": "10.1.55", "lessThanOrEqual": "10.1.59", "versionType": "semver"}, {"status": "affected", "version": "9.0.118", "lessThanOrEqual": "9.0.121", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a\u00a0regression in fix for CVE-2026-41293 can trigger request header mix-up.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a&nbsp;regression in fix for CVE-2026-41293 can trigger request header mix-up.</p><p>This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121.</p><p>Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.</p>"}]}], "references": [{"url": "https://lists.apache.org/thread/mss45z99lcdd5dtpgcn45dy82f3toswc", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "Jeppe Weikop", "type": "finder"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-09-23T16:16:46.410403Z", "id": "CVE-2026-86350", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-23T16:17:11.408Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-86350", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-23T16:16:46.410403Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-23T16:16:39.762Z"}}], "cna": {"title": "Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Jeppe Weikop"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Tomcat", "versions": [{"status": "affected", "version": "11.0.22", "versionType": "semver", "lessThanOrEqual": "11.0.25"}, {"status": "affected", "version": "10.1.55", "versionType": "semver", "lessThanOrEqual": "10.1.59"}, {"status": "affected", "version": "9.0.118", "versionType": "semver", "lessThanOrEqual": "9.0.121"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/mss45z99lcdd5dtpgcn45dy82f3toswc", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a\u00a0regression in fix for CVE-2026-41293 can trigger request header mix-up.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a&nbsp;regression in fix for CVE-2026-41293 can trigger request header mix-up.</p><p>This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121.</p><p>Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-444", "description": "CWE-444 Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling')"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-09-23T11:31:36.328Z"}}}, "cveMetadata": {"cveId": "CVE-2026-86350", "state": "PUBLISHED", "dateUpdated": "2026-09-23T16:17:11.408Z", "dateReserved": "2026-09-07T09:49:48.382Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-09-23T11:31:36.328Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache Tomcat", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "11.0.25", "status": "affected", "version": "11.0.22", "versionType": "semver"}, {"lessThanOrEqual": "10.1.59", "status": "affected", "version": "10.1.55", "versionType": "semver"}, {"lessThanOrEqual": "9.0.121", "status": "affected", "version": "9.0.118", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a\u00a0regression in fix for CVE-2026-41293 can trigger request header mix-up.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue."}], "id": "CVE-2026-86350", "lastModified": "2026-09-23T17:58:26.570", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-86350", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-23T16:16:46.410403Z", "version": "2.0.3"}}]}, "published": "2026-09-23T12:17:08.350", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread/mss45z99lcdd5dtpgcn45dy82f3toswc"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-444"}], "source": "security@apache.org", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2026:68257", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "tomcat10-main-10.1.60-0.1.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-09-16T00:00:00Z"}, {"advisory": "RHSA-2026:68258", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "tomcat11-main-11.0.26-0.1.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-09-16T00:00:00Z"}], "bugzilla": {"description": "tomcat: Apache Tomcat: HTTP/2 request smuggling due to header mix-up", "id": "2539370", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539370"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.2", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "status": "verified"}, "cwe": "CWE-444", "details": ["Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a\u00a0regression in fix for CVE-2026-41293 can trigger request header mix-up.\nThis issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121.\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.", "A flaw was found in Apache Tomcat. This vulnerability, identified as HTTP Request/Response smuggling, stems from an inconsistent interpretation of HTTP/2 requests. A regression in a prior security fix can cause request headers to be mixed up. This could allow a remote attacker to bypass security mechanisms or gain unauthorized access to sensitive information."], "name": "CVE-2026-86350", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "tomcat", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "tomcat9", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "tomcat6", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Under investigation", "package_name": "tomcat", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Under investigation", "package_name": "pki-deps:10.6/pki-servlet-engine", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Under investigation", "package_name": "tomcat", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "pki-servlet-engine", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "tomcat", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "hi/tomcat", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5", "fix_state": "Under investigation", "package_name": "jws5-tomcat", "product_name": "Red Hat JBoss Web Server 5"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:6", "fix_state": "Under investigation", "package_name": "jws6-tomcat", "product_name": "Red Hat JBoss Web Server 6"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:7", "fix_state": "Under investigation", "package_name": "jws7-tomcat", "product_name": "Red Hat JBoss Web Server 7"}], "public_date": "2026-09-23T11:31:36Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-86350\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-86350\nhttps://lists.apache.org/thread/mss45z99lcdd5dtpgcn45dy82f3toswc"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.0.22,11.0.25]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.1.55,10.1.59]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.0.118,9.0.121]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Tomcat", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "apache_tomcat", "vendor": "apache"}], "created": "2026-09-23T13:45:04.554148+00:00", "updated": "2026-09-23T18:30:06.968978+00:00", "vendors": ["apache", "apache$PRODUCT$apache_tomcat"]}