Описание
Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up.
This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121.
Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
A flaw was found in Apache Tomcat. This vulnerability, identified as HTTP Request/Response smuggling, stems from an inconsistent interpretation of HTTP/2 requests. A regression in a prior security fix can cause request headers to be mixed up. This could allow a remote attacker to bypass security mechanisms or gain unauthorized access to sensitive information.
Отчет
This vulnerability is rated as having Important impact because unauthenticated remote clients can trigger request desynchronization and header confusion across multiplexed connections, leading to potential access control bypass or data leakage across sessions. Exploitation is limited to instances actively serving HTTP/2 connections, commonly deployed in reverse proxy architectures or direct HTTPS terminations. Instances using standard HTTP/1.1 connector definitions without explicit HTTP/2 protocol upgrade handlers are not exposed to this issue.
Меры по смягчению последствий
Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | tomcat | Affected | ||
| Red Hat Enterprise Linux 10 | tomcat9 | Affected | ||
| Red Hat Enterprise Linux 6 | tomcat6 | Not affected | ||
| Red Hat Enterprise Linux 7 | tomcat | Not affected | ||
| Red Hat Enterprise Linux 8 | pki-deps:10.6/pki-servlet-engine | Not affected | ||
| Red Hat Enterprise Linux 8 | tomcat | Affected | ||
| Red Hat Enterprise Linux 9 | pki-servlet-engine | Not affected | ||
| Red Hat Enterprise Linux 9 | tomcat | Affected | ||
| Red Hat Hardened Images | hi/tomcat | Not affected | ||
| Red Hat JBoss Web Server 5 | jws5-tomcat | Will not fix |
Показывать по
Дополнительная информация
Статус:
EPSS
7.2 High
CVSS3
Связанные уязвимости
Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response ...
EPSS
7.2 High
CVSS3