CVE-2026-86350CWE-444

CVE-2026-86350

Critical · published September 23, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
22.9
In the wild
Unconfirmed
What it is

Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up.

This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121.

Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00313 · 22.9th percentile
Weakness
CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published
2026-09-23T16:17Z
References (1)
https://lists.apache.org/thread/mss45z99lcdd5dtpgcn45dy82f3toswc · [email protected]
EPSS history
Timeline
  • 25 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 23 SEP 11:31Z
    Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up
    cvelistv5