CVE-2026-41293CWE-20

Apache Tomcat: HTTP/2 request headers not validated

Critical · published May 12, 2026

CVSS v3.1
9.8
EPSS
2%
Percentile
76.8
In the wild
Unconfirmed
What it is

Improper Input Validation vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27.

Older, end of support versions may also be affected.

Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01680 · 76.8th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-05-12T15:19Z
EPSS history
Timeline
  • 12 MAY 15:19Z
    Apache Tomcat: HTTP/2 request headers not validated
    cvelistv5