CVE-2026-86350
Public on 2026-09-23
Modified on 2026-09-24
Description
Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up.
This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121.
Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121.
Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 2 - Core | tomcat | Not Affected | ||
| Amazon Linux 2 - Tomcat8.5 Extra | tomcat | No Fix Planned | ||
| Amazon Linux 2 - Tomcat9 Extra | tomcat | 2026-10-12 | ALAS2TOMCAT9-2026-029 | Fixed |
| Amazon Linux 2023 | tomcat10 | 2026-10-12 | ALAS2023-2026-3165 | Fixed |
| Amazon Linux 2027 Preview | tomcat10 | Pending Fix | ||
| Amazon Linux 2023 | tomcat11 | 2026-10-12 | ALAS2023-2026-3151 | Fixed |
| Amazon Linux 2023 | tomcat9 | 2026-10-12 | ALAS2023-2026-3166 | Fixed |
| Amazon Linux 2027 Preview | tomcat9 | Pending Fix |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 6.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N |