---
id: CVE-2026-41293
title: >-
  tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated
  (CVE-2026-41293)
summary: >-
  Apache Tomcat did not validate HTTP/2 request headers, triggering unexpected
  application behavior, as applications may presume that header values exposed
  through the Servlet API would be valid.
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'
cvssSource: vendor
cwe:
  - CWE-1286
  - CWE-20
vendor: Red Hat
product: Red Hat Enterprise Linux AppStream EUS (v. 10.0)
affected:
  - enterprise_linux 6
  - enterprise_linux 8
  - enterprise_linux 9
  - jboss_web_server 5
  - jboss_web_server 6
  - jboss_web_server 7
  - jboss_web_server_6_2_on_rhel 10
  - jboss_web_server_7_0_on_rhel 10
  - jboss_web_server_6_2_on_rhel 8
  - jboss_web_server_7_0_on_rhel 8
  - jboss_web_server_6_2_on_rhel 9
  - jboss_web_server_7_0_on_rhel 9
  - enterprise_linux_appstream_eus_v_10_0
  - enterprise_linux_appstream_v_10
  - enterprise_linux_appstream_v_8
  - enterprise_linux_appstream_e4s_v_8_8
  - enterprise_linux_appstream_tus_v_8_8
  - enterprise_linux_appstream_e4s_v_9_2
  - enterprise_linux_appstream_e4s_v_9_4
  - enterprise_linux_appstream_eus_v_9_6
  - enterprise_linux_appstream_v_9
  - jboss_web_server 6.2.4
  - jboss_web_server 7.0.0
patched:
  - jboss_web_server_6_2_on_rhel 10
  - jboss_web_server_7_0_on_rhel 10
  - jboss_web_server_6_2_on_rhel 8
  - jboss_web_server_7_0_on_rhel 8
  - jboss_web_server_6_2_on_rhel 9
  - jboss_web_server_7_0_on_rhel 9
  - enterprise_linux_appstream_eus_v_10_0
  - enterprise_linux_appstream_v_10
  - enterprise_linux_appstream_v_8
  - enterprise_linux_appstream_e4s_v_8_8
  - enterprise_linux_appstream_tus_v_8_8
  - enterprise_linux_appstream_e4s_v_9_2
  - enterprise_linux_appstream_e4s_v_9_4
  - enterprise_linux_appstream_eus_v_9_6
  - enterprise_linux_appstream_v_9
  - jboss_web_server 6.2.4
  - jboss_web_server 7.0.0
published: '2026-05-12'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T23:22:30+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41293.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41293.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-41293'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2476513'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-41293'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-41293'
  - url: 'https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r'
  - url: 'https://access.redhat.com/errata/RHSA-2026:43401'
  - url: 'https://access.redhat.com/errata/RHSA-2026:39188'
  - url: 'https://access.redhat.com/errata/RHSA-2026:67164'
  - url: 'https://access.redhat.com/errata/RHSA-2026:67163'
  - url: 'https://access.redhat.com/errata/RHSA-2026:69259'
  - url: 'https://access.redhat.com/errata/RHSA-2026:68651'
  - url: 'https://access.redhat.com/errata/RHSA-2026:68677'
  - url: 'https://access.redhat.com/errata/RHSA-2026:68680'
  - url: 'https://access.redhat.com/errata/RHSA-2026:68678'
  - url: 'https://access.redhat.com/errata/RHSA-2026:68679'
  - url: 'https://access.redhat.com/errata/RHSA-2026:68659'
  - url: 'https://access.redhat.com/errata/RHSA-2026:68660'
  - url: 'https://access.redhat.com/errata/RHSA-2026:43402'
  - url: 'https://access.redhat.com/errata/RHSA-2026:39189'
tags:
  - csaf
  - vex
  - red-hat
  - exploit-available
  - cve.org
  - score-dispute
epss: 0.01705
epssPercentile: 0.77158
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/xiaoqiMikko/tomcat-check'
  checkedAt: '2026-10-27T18:59:23.690Z'
exploitAvailable: true
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-05-14T16:40:13.006509Z'
scores:
  vendor: 7.3
  adp: 9.8
ingestedAt: '2026-09-17T19:26:25.352Z'
---

## Overview

Apache Tomcat did not validate HTTP/2 request headers, triggering unexpected application behavior, as applications may presume that header values exposed through the Servlet API would be valid.

## Vendor advisories

- **RHSA-2026:43401** · Red Hat · fixed in: Red Hat JBoss Web Server 6.2 on RHEL 10, Red Hat JBoss Web Server 6.2 on RHEL 8, Red Hat JBoss Web Server 6.2 on RHEL 9 · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43401)
- **RHSA-2026:39188** · Red Hat · fixed in: Red Hat JBoss Web Server 7.0 on RHEL 10, Red Hat JBoss Web Server 7.0 on RHEL 8, Red Hat JBoss Web Server 7.0 on RHEL 9 · released 2026-07-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:39188)
- **RHSA-2026:67164** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67164)
- **RHSA-2026:67163** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67163)
- **RHSA-2026:69259** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69259)
- **RHSA-2026:68651** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:68651)
- **RHSA-2026:68677** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68677)
- **RHSA-2026:68680** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68680)
- **RHSA-2026:68678** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68678)
- **RHSA-2026:68679** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68679)
- **RHSA-2026:68659** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68659)
- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat JBoss Web Server 5, Red Hat JBoss Web Server 6, Red Hat JBoss Web Server 7 · no fix planned: Red Hat JBoss Web Server 5, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9, … · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41293.json)
- **RHSA-2026:68660** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68660)

**tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated** — rated Moderate by Red Hat. Released 2026-05-12, updated 2026-10-16.

Affected:

- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Web Server 5
- Red Hat JBoss Web Server 6
- Red Hat JBoss Web Server 7

Fixed:

- Red Hat JBoss Web Server 6.2 on RHEL 10
- Red Hat JBoss Web Server 7.0 on RHEL 10
- Red Hat JBoss Web Server 6.2 on RHEL 8
- Red Hat JBoss Web Server 7.0 on RHEL 8
- Red Hat JBoss Web Server 6.2 on RHEL 9
- Red Hat JBoss Web Server 7.0 on RHEL 9
- Red Hat Enterprise Linux AppStream EUS (v. 10.0)
- Red Hat Enterprise Linux AppStream (v. 10)
- Red Hat Enterprise Linux AppStream (v. 8)
- Red Hat Enterprise Linux AppStream E4S (v.8.8)
- Red Hat Enterprise Linux AppStream TUS (v.8.8)
- Red Hat Enterprise Linux AppStream E4S (v.9.2)
- Red Hat Enterprise Linux AppStream E4S (v.9.4)
- Red Hat Enterprise Linux AppStream EUS (v.9.6)
- Red Hat Enterprise Linux AppStream (v. 9)
- Red Hat JBoss Web Server 6.2.4
- Red Hat JBoss Web Server 7.0.0

No fix planned:

- Red Hat JBoss Web Server 5
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 9
- Red Hat JBoss Web Server 6
- Red Hat JBoss Web Server 7

Not affected:

- Red Hat JBoss Web Server 7.0 on RHEL 10
- Red Hat JBoss Web Server 7.0 on RHEL 8
- Red Hat JBoss Web Server 7.0 on RHEL 9
- Red Hat Enterprise Linux 7
- Red Hat Hardened Images

## Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:43401
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:39188
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:67164