CVE-2026-41293

CVE-2026-41293: Apache Tomcat: HTTP/2 request headers not validated

Vendor Apache Software Foundation
Product Apache Tomcat
Weakness CWE-20 · Input validation
Published May 12, 2026
Last update May 14, 2026

CVSS base score

What the vulnerability does

Description

Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Key dates

Disclosure timeline

May 12, 2026 CVE published
May 14, 2026 Record updated