BIT-tomcat-2026-41293

vendorUSosv

Apache Tomcat: HTTP/2 request headers not validated

view advisory published 2026-05-14Licence: per source

Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.21, from 10.1.0 through 10.1.54, from 9.0.0 through 9.0.117, from 10.0.0 through 10.0.27. Older, end of support versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-41293US	—	1.70% (77th)	Exploit	2026-05-12
Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2026/05/12/13ADVISORY
https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1rADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2026-41293WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan