https://seclists.org/oss-sec/2026/q3/908: CVE-2026-86350: Apache Tomcat: gssion in fix for CVE-2026-41293 can trigger quest header mix-up

Q: Which Tomcat release lines should be reviewed for exposure?

The reported affected ranges are Tomcat 11.0.22 through 11.0.25, Tomcat 10.1.55 through 10.1.59, and Tomcat 9.0.118 through 9.0.121.

Q: Does the advisory identify fixed versions to upgrade to?

No fixed versions are identified in the provided advisory. Teams should track the referenced Apache Tomcat advisory material for remediation release information.

Q: Are exploit prerequisites, affected default settings, or temporary mitigations documented?

The provided advisory does not document attacker prerequisites, default-configuration exposure, or compensating mitigations.

Published Sep 23, 2026

Updated

Affected Software

1 affected component

Apache Tomcat>=11.0.22<=11.0.25, >=10.1.55<=10.1.59, >=9.0.118<=9.0.121

Frequently Asked Questions

Which Tomcat release lines should be reviewed for exposure?

The reported affected ranges are Tomcat 11.0.22 through 11.0.25, Tomcat 10.1.55 through 10.1.59, and Tomcat 9.0.118 through 9.0.121.

Does the advisory identify fixed versions to upgrade to?

No fixed versions are identified in the provided advisory. Teams should track the referenced Apache Tomcat advisory material for remediation release information.

Are exploit prerequisites, affected default settings, or temporary mitigations documented?

The provided advisory does not document attacker prerequisites, default-configuration exposure, or compensating mitigations.