Apache Tomcat 11.0.26 Closes an HTTP/2 Header Mix-Up Regression: CVE-2026-86350

Vulnerability overview

Apache published Tomcat 11.0.26 on 15 September 2026, and the security page for that release carries an Important entry for CVE-2026-86350. Public disclosure followed on 23 September 2026, when the Tomcat security team moved the report from its private list to the public advisory.

The defect is a regression. It arrived with the patch for CVE-2026-41293, an earlier HTTP/2 handling bug, and it survived in the 11.0.22 to 11.0.25 line until it was corrected. Because the new code reads HTTP/2 requests differently from the rest of the connector, header fields can be attached to the wrong exchange.

Mechanism and exploitation conditions

Apache summarises the problem as an inconsistent interpretation of HTTP/2 requests caused by the regression in the CVE-2026-41293 fix. The result is a request header mix-up: the connector can attribute headers to a request that belongs to a different client on the same connection.

The vendor fix commits are 192bc749 for 11.0.x, 259e938d for 10.1.x and 5adadc4e for 9.0.x. The advisory ships no proof-of-concept code, and the report was filed on 28 August 2026, roughly four weeks before publication.

Impact

A mixed-up header set has two practical consequences. Cached or proxied responses can be delivered to the wrong client, and security decisions derived from headers, such as routing rules or rate limiting, can be evaluated against the wrong request. The Tomcat project did not publish a CVSS vector for this entry. A third-party roundup of the same release lists CVE-2026-86350 at 9.1 under CWE-444; that figure belongs to the aggregator, and the vendor label is Important rather than Critical.

Affected products and scope

Three maintained branches are affected: 11.0.22 to 11.0.25, 10.1.55 to 10.1.59, and 9.0.118 to 9.0.121. Tomcat 8.5 has no CVE-2026-86350 entry. Installations that terminate HTTP/2 at the Tomcat connector are the ones in scope, while deployments that keep HTTP/2 disabled or terminate TLS elsewhere carry a smaller practical surface.

Exposure context

A ZoomEye query for app="Apache Tomcat" returns 580,597 matching assets, about 580.6k internet-facing Tomcat deployments. A CVE-scoped query, vul.cve="CVE-2026-86350", returns 0. The product-level count therefore describes Tomcat instances in general and does not identify hosts running an affected build of 11.0.22 to 11.0.25, 10.1.55 to 10.1.59 or 9.0.118 to 9.0.121.

ZoomEye Search Link: https://www.zoomeye.ai/searchResult?q=YXBwPSJBcGFjaGUgVG9tY2F0Ig%3D%3D

No exploitation in the wild is confirmed in the sources reviewed for this article.

Remediation and mitigations

Move to Tomcat 11.0.26, 10.1.60 or 9.0.122 on the branch in use. Verify the running build instead of trusting the package name, since container images and distribution backports trail the upstream release. Where an upgrade must wait, check whether HTTP/2 is enabled on the connector and consider turning it off until the maintenance window. Review HTTP/2 access log entries for unexpected header patterns, and tighten upstream proxy validation as a secondary control.