Improper input validation of HTTP/2 request headers in Apache Tomcat (CVE-2026-41293)

Apache Tomcat failed to validate HTTP/2 request headers, potentially exposing header values through the Servlet API that were not compliant with the HTTP specification. This could trigger unexpected application behaviour in applications that reasonably assumed header values would be specification compliant. Affected versions: - Apache Tomcat 11.0.0-M1 to 11.0.21 - Apache Tomcat 10.1.0-M1 to 10.1.54 - Apache Tomcat 9.0.0.M1 to 9.0.117 - older, unsupported versions may also be affected We recommend updating to: Apache Tomcat 11.0.22, Apache Tomcat 10.1.55, Apache Tomcat 9.0.118. CVSS 9.8 · our assessment: act_now Reference: https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r Details: https://vuln.today/cve/CVE-2026-41293