~ / search / GHSA-r29c-68gh-xp6x

GHSA-r29c-68gh-xp6x

Apache Tomcat - HTTP/2 request headers not validated

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-41293

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.tomcat.embed:tomcat-embed-core >= 8.5.0, < 9.0.118 9.0.118
Maven org.apache.tomcat.embed:tomcat-embed-core >= 10.1.0-M1, < 10.1.55 10.1.55
Maven org.apache.tomcat.embed:tomcat-embed-core >= 11.0.0-M1, < 11.0.22 11.0.22
Maven org.apache.tomcat:tomcat >= 8.5.0, < 9.0.118 9.0.118
Maven org.apache.tomcat:tomcat >= 10.1.0-M1, < 10.1.55 10.1.55
Maven org.apache.tomcat:tomcat >= 11.0.0-M1, < 11.0.22 11.0.22
Maven org.apache.tomcat:tomcat-coyote >= 8.5.0, < 9.0.118 9.0.118
Maven org.apache.tomcat:tomcat-coyote >= 10.1.0-M1, < 10.1.55 10.1.55
Maven org.apache.tomcat:tomcat-coyote >= 11.0.0-M1, < 11.0.22 11.0.22

Details

As written in the advisory (Markdown source, shown as plain text).

Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache Tomcat 9.0.0.M1 to 9.0.117 Older, unsupported versions may also be affected Description: HTTP/2 request headers were not validated which may have triggered unexpected application behaviour if the application (quite reasonably) assumed that header value exposed through the Servlet API would be specification compliant. Mitigation: Users of the affected versions should apply one of the following mitigations: - Upgrade to Apache Tomcat 11.0.22 or later - Upgrade to Apache Tomcat 10.1.55 or later - Upgrade to Apache Tomcat 9.0.118 or later Credit: This issue was identified by Dawit Jeong (@dawitngoliath)

References

External links from the advisory. They lead to third-party sites.