Apache Tomcat HTTP/2 Request Smuggling Vulnerability

CVE-2026-86350 is a critical HTTP/2 request smuggling vulnerability affecting Apache Tomcat versions through 9.0.121, 10.1.55-10.1.59, and 11.0.22-11.0.25. The flaw originates from a regression in the HPACK header validation logic introduced during the refactor for CVE-2026-41293. When an attacker sends a specially crafted HTTP/2 request containing an invalid HPACK field, the decoder throws an exception and halts processing, preventing subsequent fields in that request from being added to the HPACK dynamic table.

Because the dynamic table state becomes desynchronized, subsequent HTTP/2 requests multiplexed over the same TCP connection will index headers against an incorrect or stale table state. This allows for header mixing or request smuggling, where an attacker can influence the interpretation of later requests. This vulnerability is rated with a CVSS score of 9.1 and represents a significant risk for environments relying on HTTP/2 multiplexing. The vulnerability does not provide direct remote code execution, but facilitates security bypasses by poisoning the request context.

Attack Chain

1. Attacker establishes a standard HTTP/2 connection with the target Apache Tomcat server via a preface.
2. Attacker initiates an HTTP/2 stream (Stream 1) and submits a HEADERS frame containing a malformed or invalid field value.
3. The HpackDecoder processes the stream and encounters the invalid field, triggering an IllegalArgumentException.
4. The decoder terminates the processing of Stream 1, intentionally failing to update the HPACK dynamic table with subsequent valid headers.
5. The server keeps the TCP connection open, maintaining the desynchronized dynamic table state.
6. Attacker initiates a second HTTP/2 stream (Stream 2) on the same connection, using indices that rely on the expected state of the dynamic table.
7. The Tomcat server processes Stream 2 using the corrupted table state, causing the server to misinterpret the attacker's headers.
8. The final objective is achieved when the smuggled request is processed with the attacker's injected header context, potentially bypassing access controls or application logic.

Impact

Successful exploitation allows an unauthenticated attacker to smuggle requests, potentially bypassing security controls, gaining unauthorized access to sensitive application paths, or manipulating request routing. While not a direct RCE, the ability to desynchronize request headers allows for complex application-layer attacks. The vulnerability affects a wide range of Tomcat deployments globally where HTTP/2 is enabled.

Recommendation

1. Upgrade all instances of Apache Tomcat to 9.0.122, 10.1.60, 11.0.26, or newer immediately to patch the HPACK validation regression.
2. If an immediate upgrade is not possible, disable HTTP/2 support in the Tomcat configuration until patching is complete.
3. Ensure the 'examples' web application is removed from production environments to reduce the surface area for testing and exploitation.
4. Hunt for anomalous HTTP/2 traffic patterns or logs indicating frequent IllegalArgumentException events originating from the org.apache.coyote.http2 package in server logs.