{"id":"CVE-2026-41293","title":"tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)","summary":"Apache Tomcat did not validate HTTP/2 request headers, triggering unexpected application behavior, as applications may presume that header values exposed through the Servlet API would be valid.","severity":"high","cvss":7.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cvssSource":"vendor","cwe":["CWE-1286","CWE-20"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream EUS (v. 10.0)","affected":["enterprise_linux 6","enterprise_linux 8","enterprise_linux 9","jboss_web_server 5","jboss_web_server 6","jboss_web_server 7","jboss_web_server_6_2_on_rhel 10","jboss_web_server_7_0_on_rhel 10","jboss_web_server_6_2_on_rhel 8","jboss_web_server_7_0_on_rhel 8","jboss_web_server_6_2_on_rhel 9","jboss_web_server_7_0_on_rhel 9","enterprise_linux_appstream_eus_v_10_0","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_8","enterprise_linux_appstream_e4s_v_8_8","enterprise_linux_appstream_tus_v_8_8","enterprise_linux_appstream_e4s_v_9_2","enterprise_linux_appstream_e4s_v_9_4","enterprise_linux_appstream_eus_v_9_6","enterprise_linux_appstream_v_9","jboss_web_server 6.2.4","jboss_web_server 7.0.0"],"patched":["jboss_web_server_6_2_on_rhel 10","jboss_web_server_7_0_on_rhel 10","jboss_web_server_6_2_on_rhel 8","jboss_web_server_7_0_on_rhel 8","jboss_web_server_6_2_on_rhel 9","jboss_web_server_7_0_on_rhel 9","enterprise_linux_appstream_eus_v_10_0","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_8","enterprise_linux_appstream_e4s_v_8_8","enterprise_linux_appstream_tus_v_8_8","enterprise_linux_appstream_e4s_v_9_2","enterprise_linux_appstream_e4s_v_9_4","enterprise_linux_appstream_eus_v_9_6","enterprise_linux_appstream_v_9","jboss_web_server 6.2.4","jboss_web_server 7.0.0"],"published":"2026-05-12","updated":"2026-10-16","sourceUpdated":"2026-10-16T23:22:30+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41293.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41293.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-41293"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476513"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41293"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41293"},{"url":"https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r"},{"url":"https://access.redhat.com/errata/RHSA-2026:43401"},{"url":"https://access.redhat.com/errata/RHSA-2026:39188"},{"url":"https://access.redhat.com/errata/RHSA-2026:67164"},{"url":"https://access.redhat.com/errata/RHSA-2026:67163"},{"url":"https://access.redhat.com/errata/RHSA-2026:69259"},{"url":"https://access.redhat.com/errata/RHSA-2026:68651"},{"url":"https://access.redhat.com/errata/RHSA-2026:68677"},{"url":"https://access.redhat.com/errata/RHSA-2026:68680"},{"url":"https://access.redhat.com/errata/RHSA-2026:68678"},{"url":"https://access.redhat.com/errata/RHSA-2026:68679"},{"url":"https://access.redhat.com/errata/RHSA-2026:68659"},{"url":"https://access.redhat.com/errata/RHSA-2026:68660"},{"url":"https://access.redhat.com/errata/RHSA-2026:43402"},{"url":"https://access.redhat.com/errata/RHSA-2026:39189"}],"tags":["csaf","vex","red-hat","exploit-available","cve.org","score-dispute"],"epss":0.01705,"epssPercentile":0.77158,"exploits":{"github":1,"githubRepos":["https://github.com/xiaoqiMikko/tomcat-check"],"checkedAt":"2026-10-27T18:59:23.690Z"},"exploitAvailable":true,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-05-14T16:40:13.006509Z"},"scores":{"vendor":7.3,"adp":9.8},"ingestedAt":"2026-09-17T19:26:25.352Z","slug":"CVE-2026-41293","body":"## Overview\n\nApache Tomcat did not validate HTTP/2 request headers, triggering unexpected application behavior, as applications may presume that header values exposed through the Servlet API would be valid.\n\n## Vendor advisories\n\n- **RHSA-2026:43401** · Red Hat · fixed in: Red Hat JBoss Web Server 6.2 on RHEL 10, Red Hat JBoss Web Server 6.2 on RHEL 8, Red Hat JBoss Web Server 6.2 on RHEL 9 · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43401)\n- **RHSA-2026:39188** · Red Hat · fixed in: Red Hat JBoss Web Server 7.0 on RHEL 10, Red Hat JBoss Web Server 7.0 on RHEL 8, Red Hat JBoss Web Server 7.0 on RHEL 9 · released 2026-07-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:39188)\n- **RHSA-2026:67164** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67164)\n- **RHSA-2026:67163** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67163)\n- **RHSA-2026:69259** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69259)\n- **RHSA-2026:68651** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:68651)\n- **RHSA-2026:68677** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68677)\n- **RHSA-2026:68680** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68680)\n- **RHSA-2026:68678** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68678)\n- **RHSA-2026:68679** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68679)\n- **RHSA-2026:68659** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68659)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat JBoss Web Server 5, Red Hat JBoss Web Server 6, Red Hat JBoss Web Server 7 · no fix planned: Red Hat JBoss Web Server 5, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9, … · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41293.json)\n- **RHSA-2026:68660** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68660)\n\n**tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated** — rated Moderate by Red Hat. Released 2026-05-12, updated 2026-10-16.\n\nAffected:\n\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat JBoss Web Server 5\n- Red Hat JBoss Web Server 6\n- Red Hat JBoss Web Server 7\n\nFixed:\n\n- Red Hat JBoss Web Server 6.2 on RHEL 10\n- Red Hat JBoss Web Server 7.0 on RHEL 10\n- Red Hat JBoss Web Server 6.2 on RHEL 8\n- Red Hat JBoss Web Server 7.0 on RHEL 8\n- Red Hat JBoss Web Server 6.2 on RHEL 9\n- Red Hat JBoss Web Server 7.0 on RHEL 9\n- Red Hat Enterprise Linux AppStream EUS (v. 10.0)\n- Red Hat Enterprise Linux AppStream (v. 10)\n- Red Hat Enterprise Linux AppStream (v. 8)\n- Red Hat Enterprise Linux AppStream E4S (v.8.8)\n- Red Hat Enterprise Linux AppStream TUS (v.8.8)\n- Red Hat Enterprise Linux AppStream E4S (v.9.2)\n- Red Hat Enterprise Linux AppStream E4S (v.9.4)\n- Red Hat Enterprise Linux AppStream EUS (v.9.6)\n- Red Hat Enterprise Linux AppStream (v. 9)\n- Red Hat JBoss Web Server 6.2.4\n- Red Hat JBoss Web Server 7.0.0\n\nNo fix planned:\n\n- Red Hat JBoss Web Server 5\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 9\n- Red Hat JBoss Web Server 6\n- Red Hat JBoss Web Server 7\n\nNot affected:\n\n- Red Hat JBoss Web Server 7.0 on RHEL 10\n- Red Hat JBoss Web Server 7.0 on RHEL 8\n- Red Hat JBoss Web Server 7.0 on RHEL 9\n- Red Hat Enterprise Linux 7\n- Red Hat Hardened Images\n\n## Remediation\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:43401\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:39188\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:67164","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":40.2,"likelihood":0.3,"exploitation":12,"ransomware":0},"changes":[{"seq":206956,"id":"CVE-2026-41293","ts":1789749718283,"field":"cvss","old":"9.8","new":"7.3"},{"seq":206955,"id":"CVE-2026-41293","ts":1789749718283,"field":"severity","old":"critical","new":"high"}]}