REDHAT-BUG-2539370: High severity Apache Tomcat vulnerability

Q: Which Tomcat deployments need remediation?

Deployments running Tomcat 11.0.22 through 11.0.25, 10.1.55 through 10.1.59, or 9.0.118 through 9.0.121 are affected. Upgrade to 11.0.26, 10.1.60, or 9.0.122, respectively.

Q: What is the impact of successful exploitation?

The flaw can cause inconsistent interpretation of HTTP/2 requests, resulting in HTTP request/response smuggling and request-header mix-up.

Published Sep 23, 2026

Updated

Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up.

This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121.

Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

Affected Software

1 affected component

Apache Tomcat>=11.0.22<=11.0.25, >=10.1.55<=10.1.59, >=9.0.118<=9.0.121

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Tomcat to a version that resolves this vulnerability.
Fixed in 11.0.26
Upgrade
Upgrade Apache Tomcat to a version that resolves this vulnerability.
Fixed in 10.1.60
Upgrade
Upgrade Apache Tomcat to a version that resolves this vulnerability.
Fixed in 9.0.122

Event History

Sep 23, 2026

Data Sourced

via Red Hat·11:51 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Tomcat deployments need remediation?

Deployments running Tomcat 11.0.22 through 11.0.25, 10.1.55 through 10.1.59, or 9.0.118 through 9.0.121 are affected. Upgrade to 11.0.26, 10.1.60, or 9.0.122, respectively.

What is the impact of successful exploitation?