Skip to content
Threat Feed
Subscribe

Product

Apache Tomcat (<= 9.0.121, 10.1.55-10.1.59, 11.0.22-11.0.25)

1 brief RSS
critical advisory

Apache Tomcat HTTP/2 Request Smuggling Vulnerability

A critical HTTP/2 request smuggling vulnerability, CVE-2026-86350, allows unauthenticated attackers to induce dynamic table desynchronization in Apache Tomcat via crafted header blocks.

Apache Tomcat vulnerability webserver request-smuggling
1t 2c