CVE-2026-41293

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-41293
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-41293.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-41293
Aliases
Downstream
CGA (47)
CLEANSTART (8)
CLSA (3)
DEBIAN (1)
MGASA (1)
MINI (9)
OESA (1)
openSUSE (6)
RHSA (12)
RLSA (4)
ROOT (1)
SUSE (7)
UBUNTU (1)
Related
ALSA (4)
openSUSE (6)
SUSE (7)
Published
2026-05-12T15:19:35Z
Modified
2026-09-22T12:41:44Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Apache Tomcat: HTTP/2 request headers not validated
Details

Improper Input Validation vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also be affected.

Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Database specific 
{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-20"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41293.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "11.0.0-M1"
                },
                {
                    "last_affected": "11.0.21"
                },
                {
                    "introduced": "10.1.0-M1"
                },
                {
                    "last_affected": "10.1.54"
                },
                {
                    "introduced": "9.0.0.M1"
                },
                {
                    "last_affected": "9.0.117"
                },
                {
                    "introduced": "10.0.0-M1"
                },
                {
                    "last_affected": "10.0.27"
                },
                {
                    "introduced": "8.5.0"
                },
                {
                    "last_affected": "8.5.100"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "11.0.0-M1"
                },
                {
                    "fixed": "11.0.21"
                },
                {
                    "introduced": "10.1.0-M1"
                },
                {
                    "fixed": "10.1.54"
                },
                {
                    "introduced": "9.0.0.M1"
                },
                {
                    "fixed": "9.0.117"
                },
                {
                    "introduced": "10.0.0-M1"
                },
                {
                    "fixed": "10.0.27"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}
References

Affected packages

Git / github.com/apache/tomcat

Affected ranges

Type
GIT
Repo
https://github.com/apache/tomcat
Events
Introduced
e37b977db6f47e4380ad67114a49e8568951c953
Last Affected
eddcf278ad919382608ada1898b2c5b63675c6d5
Introduced
4c8b650437e2464c1c31c6598a263b3805b7a81f
Last Affected
ca8720d41f3be917dc3fcdd03fcca8d3152a13fb
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "8.5.0"
        },
        {
            "last_affected": "8.5.100"
        },
        {
            "introduced": "10.0.0"
        },
        {
            "last_affected": "10.0.27"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-41293.json"