CVE-2026-86350: Apache Tomcat HTTP Request Smuggling Flaw

CVE-2026-86350 Overview

CVE-2026-86350 is an HTTP request smuggling vulnerability in Apache Tomcat introduced by a regression in the fix for CVE-2026-41293. The flaw causes inconsistent interpretation of HTTP/2 requests, allowing attackers to trigger request header mix-up between concurrent streams. Affected versions include Apache Tomcat 11.0.22 through 11.0.25, 10.1.55 through 10.1.59, and 9.0.118 through 9.0.121. The vulnerability is classified under [CWE-444] (Inconsistent Interpretation of HTTP Requests). Attackers can exploit this issue over the network without authentication or user interaction.

Critical Impact
Remote unauthenticated attackers can smuggle HTTP/2 requests, mix headers between streams, and bypass front-end security controls to reach protected back-end resources.

Affected Products

Apache Tomcat 11.0.22 through 11.0.25
Apache Tomcat 10.1.55 through 10.1.59
Apache Tomcat 9.0.118 through 9.0.121

Discovery Timeline

2026-09-23 - CVE-2026-86350 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-86350

Vulnerability Analysis

The vulnerability resides in Apache Tomcat's HTTP/2 protocol handling. A regression introduced while patching CVE-2026-41293 caused the server to inconsistently interpret HTTP/2 request framing. Under specific conditions, headers belonging to one HTTP/2 stream can be associated with another concurrent stream. This header mix-up enables request smuggling, where a malicious client injects or reassigns headers between multiplexed requests. Attackers can leverage this behavior to bypass authentication headers, forge routing decisions at reverse proxies, poison caches, or hijack sessions of legitimate users sharing the same connection.

Root Cause

The root cause is a regression in the code path that handles HTTP/2 stream header association. The fix released for CVE-2026-41293 altered how headers are tracked across multiplexed streams. This change introduced an inconsistency between how Tomcat and upstream HTTP/2 intermediaries interpret request boundaries, violating [CWE-444].

Attack Vector

Exploitation requires only network access to a vulnerable Tomcat instance exposing HTTP/2. An attacker crafts concurrent HTTP/2 streams designed to trigger the header mix-up condition. No authentication or user interaction is required. Successful exploitation can smuggle requests past front-end proxies, expose sensitive data, or manipulate the identity context of legitimate requests processed on the same connection.

No public proof-of-concept code has been released for CVE-2026-86350 at the time of publication. Technical details are available in the Apache Mailing List Thread.

Detection Methods for CVE-2026-86350

Indicators of Compromise

Anomalous HTTP/2 request patterns showing header fields inconsistent with the client session or authenticated user context.
Access log entries where authenticated user identifiers appear on requests originating from unrelated source connections.
Unexpected 4xx or 5xx responses correlated with high-concurrency HTTP/2 streams targeting the same origin.
Cache poisoning symptoms such as responses served with incorrect Host or authorization contexts.

Detection Strategies

Compare request headers logged at the reverse proxy against those received by Tomcat to identify divergence indicative of smuggling.
Deploy web application firewall rules that flag malformed or duplicated HTTP/2 pseudo-headers across concurrent streams.
Enable HTTP/2 frame-level logging where feasible and correlate stream IDs with header sets for post-hoc analysis.

Monitoring Recommendations

Monitor Apache Tomcat versions across the fleet and alert on any host running an affected 9.0.x, 10.1.x, or 11.0.x build.
Track sudden shifts in HTTP/2 stream concurrency, error rates, and average request latency on Tomcat-fronted services.
Ingest Tomcat access logs and reverse proxy logs into a centralized data lake for cross-tier request correlation.

How to Mitigate CVE-2026-86350

Immediate Actions Required

Inventory all Apache Tomcat instances and identify hosts running 11.0.22-11.0.25, 10.1.55-10.1.59, or 9.0.118-9.0.121.
Upgrade affected instances to Apache Tomcat 11.0.26, 10.1.60, or 9.0.122 without delay.
Restart Tomcat services after upgrade to ensure the patched HTTP/2 handler is loaded.
Review reverse proxy and load balancer logs for signs of prior smuggling attempts against exposed HTTP/2 endpoints.

Patch Information

The Apache Tomcat project has released fixed versions 11.0.26, 10.1.60, and 9.0.122. These releases correct the HTTP/2 header association regression introduced by the CVE-2026-41293 fix. Upgrade details are published in the Apache Mailing List Thread.

Workarounds

Disable HTTP/2 on affected Tomcat connectors and fall back to HTTP/1.1 until patches are applied.
Terminate HTTP/2 at an unaffected front-end proxy that re-serializes requests to HTTP/1.1 before forwarding to Tomcat.
Restrict network exposure of vulnerable Tomcat instances to trusted clients only until an upgrade is completed.

bash

# Disable HTTP/2 upgrade protocol on a Tomcat connector in server.xml
# Remove or comment out the following element inside <Connector>:
# <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />

# Verify running version after patching
catalina.sh version