Executive brief
Apache Tomcat is a widely used web server and application container for Java-based software. A vulnerability in its handling of HTTP/2 web traffic could allow attackers to send specially crafted request headers that bypass standard security checks. This may lead to unexpected application behavior, potentially allowing unauthorized access to data or disruption of services depending on how the hosted application processes these headers.
Technical details
An improper input validation vulnerability exists in Apache Tomcat's HTTP/2 implementation. The server fails to validate HTTP/2 request headers against specifications before exposing them to applications through the Servlet API. If an application assumes these headers are specification-compliant, an attacker can trigger unexpected logic or security bypasses by providing malformed header values. The vulnerability is reachable over the network without authentication. Fixes have been released in versions 11.0.22, 10.1.55, and 9.0.118, which introduce header filtering to align HTTP/2 behavior with HTTP/1.1.
Affected products
- Apache Tomcat 11.0.0-M1 to 11.0.21, 10.1.0-M1 to 10.1.54, 9.0.0.M1 to 9.0.117, 10.0.0-M1 to 10.0.27, 8.5.0 to 8.5.100
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory
References
- https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r
- http://www.openwall.com/lists/oss-security/2026/05/12/13
- https://github.com/apache/tomcat/commit/19f17a257797e8d139b33ff9c88d362a273be148
- https://github.com/apache/tomcat/commit/1c70480466572c9192ed412ebefcd43fc63137fd
- https://github.com/apache/tomcat/commit/2a2476460e823789f530a22207873ea8cd6eff3b