Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-41293

Apache Tomcat: HTTP/2 request headers not validated

cve-program · severity unknownCVSS unknownCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-41293

Published

Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-41293

Published

Apache Tomcat

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "product": "Apache Tomcat",
                    "vendor": "Apache Software Foundation",
                    "versions": [
                        {
                            "lessThanOrEqual": "11.0.21",
                            "status": "affected",
                            "version": "11.0.0-M1",
                            "versionType": "semver"
                        },
                        {
                            "lessThanOrEqual": "10.1.54",
                            "status": "affected",
                            "version": "10.1.0-M1",
                            "versionType": "semver"
                        },
                        {
                            "lessThanOrEqual": "9.0.117",
                            "status": "affected",
                            "version": "9.0.0.M1",
                            "versionType": "semver"
                        },
                        {
                            "lessThanOrEqual": "10.0.27",
                            "status": "affected",
                            "version": "10.0.0-M1",
                            "versionType": "semver"
                        },
                        {
                            "lessThanOrEqual": "8.5.100",
                            "status": "affected",
                            "version": "8.5.0",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON