CVE-2026-86350

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.22 through 11.0.25 Apache Tomcat versions 10.1.55 through 10.1.59 Apache Tomcat versions 9.0.118 through 9.0.121

Description An inconsistent interpretation of HTTP/2 requests, known as HTTP Request/Response smuggling, occurs due to a regression in a previous fix. This issue can trigger a request header mix-up. Approximately 580,600 instances are identified globally.

Recommendations Upgrade versions 11.0.22 through 11.0.25 to 11.0.26. Upgrade versions 10.1.55 through 10.1.59 to 10.1.60. Upgrade versions 9.0.118 through 9.0.121 to 9.0.122.