CVE-2026-86350

Public on 2026-09-23
Modified on 2026-09-24
Description
Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up.



This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121.



Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Severity
Medium severity
Medium
See what this means
CVSS v3 Base Score
6.5
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Tomcat9 Extra tomcat Pending Fix
Amazon Linux 2 - Core tomcat Not Affected
Amazon Linux 2 - Tomcat8.5 Extra tomcat No Fix Planned
Amazon Linux 2023 tomcat10 Pending Fix
Amazon Linux 2027 Preview tomcat10 Pending Fix
Amazon Linux 2023 tomcat11 Pending Fix
Amazon Linux 2023 tomcat9 Pending Fix
Amazon Linux 2027 Preview tomcat9 Pending Fix

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

References

FAQs regarding Amazon Linux ALAS/CVE Severity Red Hat: CVE-2026-86350 Mitre: CVE-2026-86350