Is CVE-2026-86350 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86350 being exploited in the wild.

How severe is CVE-2026-86350?

Critical severity, with a CVSS score of 9.1, published 23 September 2026.

Which products and versions are affected?

Apache Tomcat 11.0.22-11.0.25, 10.1.55-10.1.59, 9.0.118-9.0.121.

Is there a fix for CVE-2026-86350?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86350 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86350?

Check whether you run Apache Tomcat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86350: Apache Tomcat HTTP/2 request smuggling via header mix-up

CVE-2026-86350 · Severity: critical · CVSS 9.1 · Published 2026-09-23

Apache Tomcat, a widely-used web server and servlet container, contains a vulnerability in how it interprets HTTP/2 requests that can cause request headers to be mixed up between different requests. An attacker can exploit this to smuggle malicious requests or responses, potentially leading to unauthorized access, data theft, or server compromise without needing any special privileges or user interaction.

Technologies: Apache Tomcat. Vendors: Apache.

Quick answers

Is CVE-2026-86350 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86350 being exploited in the wild.
How severe is CVE-2026-86350?: Critical severity, with a CVSS score of 9.1, published 23 September 2026.
Which products and versions are affected?: Apache Tomcat 11.0.22-11.0.25, 10.1.55-10.1.59, 9.0.118-9.0.121.
Is there a fix for CVE-2026-86350?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86350 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86350?: Check whether you run Apache Tomcat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an HTTP Request/Response smuggling flaw caused by a regression in the fix for CVE-2026-41293, resulting in inconsistent interpretation of HTTP/2 requests in Tomcat's HTTP/2 request processing logic. An attacker on the network can craft specially-formed HTTP/2 requests to trigger header mix-up between concurrent requests, allowing request/response confusion attacks without authentication. Patched versions are available for all affected release branches.

Affected products

Apache Tomcat 11.0.22-11.0.25, 10.1.55-10.1.59, 9.0.118-9.0.121

Timeline

2026-09-23: disclosed

References

https://lists.apache.org/thread/mss45z99lcdd5dtpgcn45dy82f3toswc

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.