CVE-2026-86350

Cve • September 23, 2026

Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

CWE-444 : Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling')

Default Status: unaffected

external site vendor-advisory

Authorized Data Publishers

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities Discovered in Apache Tomcat Five critical vulnerabilities have been identified in Apache Tomcat, affecting versions from 8.5.0 to 11.0.25. These include CVE-2026-77762, a race condition allowing HTTP/2 request injection; CVE-2026-78383, enabling denial of service via unauthenticated AJP requests; CVE-2026-77791, which allows DoS attacks through uncontrolled resource consumption; CVE-2026-78437, related to incomplete cleanup causing request failures; and CVE-2026-86350, a regression causing HTTP request smuggling. Users are advised to upgrade to the latest versions (11.0.26, 10.1.60, or 9.0.122) to mitigate these vulnerabilities. The vulnerabilities impact both supported and end-of-life versions of Apache Tomcat, posing significant risks to web applications relying on this server software. 5 sources 61

Extracted Entities

CVE-2026-86350

The full story

Extracted Entities

CVEs (2)

CWE Weaknesses (1)

Platforms (1)

Vulnerabilities (1)