Apache Tomcat HTTP/2 Header Validation Issue: Early Warning
- Severity
- HIGH
- Affected component
- apache tomcat (maven)
- Patched version
- 11.0.22 || 10.1.55 || 9.0.118
An early warning has been issued for a critical vulnerability in Apache Tomcat versions 11.0.0-M1 to 11.0.21, 10.1.0-M1 to 10.1.54, and 9.0.0.M1 to 9.0.117. These versions do not validate HTTP/2 request headers, which may lead to unexpected application behavior.
What happened
Apache Tomcat versions 11.0.0-M1 to 11.0.21, 10.1.0-M1 to 10.1.54, and 9.0.0.M1 to 9.0.117 reportedly do not validate HTTP/2 request headers. This oversight may result in unexpected application behavior, as the server does not properly scrutinize incoming HTTP/2 headers. The vulnerability, tracked as GHSA-R29C-68GH-XP6X and CVE-2026-41293, has a high severity rating. It is under investigation whether older, unsupported versions are also affected.
This issue was first flagged on May 12, 2026, and has not yet been exploited in the wild according to current reports. The vulnerability does not appear to be part of a supply-chain attack at this time. Users of the affected versions are advised to take immediate action to assess their exposure and apply the recommended patches.
What to do about it
- Upgrade to Apache Tomcat 11.0.22 or later, 10.1.55 or later, or 9.0.118 or later to mitigate the vulnerability.
- Review your application's use of HTTP/2 headers and ensure that they are being properly validated post-upgrade.
- Monitor the primary sources for updates on the vulnerability and any additional patches that may be released.
How 0Day would have caught this
apache tomcat is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using Apache Tomcat versions 11.0.0-M1 to 11.0.21, 10.1.0-M1 to 10.1.54, or 9.0.0.M1 to 9.0.117.
What should I do right now?
Immediately upgrade to Apache Tomcat 11.0.22 or later, 10.1.55 or later, or 9.0.118 or later.
Is this vulnerability being exploited in the wild?
There are no reports of this vulnerability being exploited in the wild at this time.
Are there any known workarounds for this issue?
No official workarounds have been published. The recommended action is to upgrade to a patched version.