# CVE-2026-86350

HTTP/2 request-smuggling regression in Apache Tomcat causes header mix-ups.

- Page: https://www.vulneraibility.com/cve/CVE-2026-86350
- CVSS: 9.1
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.48% (percentile 41.9)
- Unvetted proof-of-concept code on GitHub: 1 GitHub proof of concept (first 2026-09-25)
- CISA SSVC: exploitation none, automatable yes, technical impact total (assessed 2026-09-23)
- Weakness: CWE-444
- Published: 2026-09-23

## Affected versions

- Apache Software Foundation Apache Tomcat: affected >= 11.0.22 and <= 11.0.25; >= 10.1.55 and <= 10.1.59; >= 9.0.118 and <= 9.0.121

A version outside these ranges is not a statement that it is unaffected.

## Impact

HTTP/2 request/response smuggling causing header mix-up; can enable request hijack, cache poisoning, auth bypass, data leakage, and session takeover.

## Action

Immediate action required

## Recommendation

Upgrade to 11.0.26, 10.1.60 or 9.0.122 immediately.

## References

- [advisory] https://lists.apache.org/thread/mss45z99lcdd5dtpgcn45dy82f3toswc

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.