GHSA-R29C-68GH-XP6X严重已审查

Apache Tomcat - HTTP/2 request headers not validated

OSV 1.4.0 · github-reviewed · 修改于 2026-09-01 05:04

发布时间

2026-05-13 02:30

GitHub 审查时间

2026-05-19 04:28

NVD 发布时间

2026-05-13 00:16

源文件

advisories/github-reviewed/2026/05/GHSA-r29c-68gh-xp6x/GHSA-r29c-68gh-xp6x.json

公告说明

Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache Tomcat 9.0.0.M1 to 9.0.117 Older, unsupported versions may also be affected

Description: HTTP/2 request headers were not validated which may have triggered unexpected application behaviour if the application (quite reasonably) assumed that header value exposed through the Servlet API would be specification compliant.

Mitigation: Users of the affected versions should apply one of the following mitigations:

Upgrade to Apache Tomcat 11.0.22 or later
Upgrade to Apache Tomcat 10.1.55 or later
Upgrade to Apache Tomcat 9.0.118 or later

Credit: This issue was identified by Dawit Jeong (@dawitngoliath)

受影响的软件包

Maven

org.apache.tomcat.embed:tomcat-embed-core

ECOSYSTEM

标识信息

别名 / CVE

CVE-2026-41293

CWE

CWE-20

软件生态

Maven

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

原始 OSV JSON

{
  "id": "GHSA-r29c-68gh-xp6x",
  "aliases": [
    "CVE-2026-41293"
  ],
  "details": "Versions Affected:\nApache Tomcat 11.0.0-M1 to 11.0.21\nApache Tomcat 10.1.0-M1 to 10.1.54\nApache Tomcat 9.0.0.M1 to 9.0.117\nOlder, unsupported versions may also be affected\n\nDescription:\nHTTP/2 request headers were not validated which may have triggered\nunexpected application behaviour if the application (quite reasonably)\nassumed that header value exposed through the Servlet API would be\nspecification compliant.\n\nMitigation:\nUsers of the affected versions should apply one of the following\nmitigations:\n- Upgrade to Apache Tomcat 11.0.22 or later\n- Upgrade to Apache Tomcat 10.1.55 or later\n- Upgrade to Apache Tomcat 9.0.118 or later\n\nCredit:\nThis issue was identified by Dawit Jeong (@dawitngoliath)",
  "summary": "Apache Tomcat - HTTP/2 request headers not validated",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "8.5.0"
            },
            {
              "fixed": "9.0.118"
            }
          ]
        }
      ],
      "package": {
        "name": "org.apache.tomcat.embed:tomcat-embed-core",
        "ecosystem": "Maven"
      }
    },
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "10.1.0-M1"
            },
            {
              "fixed": "10.1.55"
            }
          ]
        }
      ],
      "package": {
        "name": "org.apache.tomcat.embed:tomcat-embed-core",
        "ecosystem": "Maven"
      }
    },
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "11.0.0-M1"
            },
            {
              "fixed": "11.0.22"
            }
          ]
        }
      ],
      "package": {
        "name": "org.apache.tomcat.embed:tomcat-embed-core",
        "ecosystem": "Maven"
      }
    },
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "8.5.0"
            },
            {
              "fixed": "9.0.118"
            }
          ]
        }
      ],
      "package": {
        "name": "org.apache.tomcat:tomcat",
        "ecosystem": "Maven"
      }
    },
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "10.1.0-M1"
            },
            {
              "fixed": "10.1.55"
            }
          ]
        }
      ],
      "package": {
        "name": "org.apache.tomcat:tomcat",
        "ecosystem": "Maven"
      }
    },
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "11.0.0-M1"
            },
            {
              "fixed": "11.0.22"
            }
          ]
        }
      ],
      "package": {
        "name": "org.apache.tomcat:tomcat",
        "ecosystem": "Maven"
      }
    },
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "8.5.0"
            },
            {
              "fixed": "9.0.118"
            }
          ]
        }
      ],
      "package": {
        "name": "org.apache.tomcat:tomcat-coyote",
        "ecosystem": "Maven"
      }
    },
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "10.1.0-M1"
            },
            {
              "fixed": "10.1.55"
            }
          ]
        }
      ],
      "package": {
        "name": "org.apache.tomcat:tomcat-coyote",
        "ecosystem": "Maven"
      }
    },
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "11.0.0-M1"
            },
            {
              "fixed": "11.0.22"
            }
          ]
        }
      ],
      "package": {
        "name": "org.apache.tomcat:tomcat-coyote",
        "ecosystem": "Maven"
      }
    }
  ],
  "modified": "2026-08-31T21:04:40Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "published": "2026-05-12T18:30:38Z",
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41293",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/apache/tomcat/commit/19f17a257797e8d139b33ff9c88d362a273be148",
      "type": "WEB"
    },
    {
      "url": "https://github.com/apache/tomcat/commit/1c70480466572c9192ed412ebefcd43fc63137fd",
      "type": "WEB"
    },
    {
      "url": "https://github.com/apache/tomcat/commit/2a2476460e823789f530a22207873ea8cd6eff3b",
      "type": "WEB"
    },
    {
      "url": "https://github.com/apache/tomcat/commit/3915fd27e6810b14ccd21e3d900bd8faef44d3df",
      "type": "WEB"
    },
    {
      "url": "https://github.com/apache/tomcat/commit/57c2b3bfd62792631e1df24cf4237b990a0b36fa",
      "type": "WEB"
    },
    {
      "url": "https://github.com/apache/tomcat/commit/c2925554c677da57390f940d856871e18daaacab",
      "type": "WEB"
    },
    {
      "url": "https://github.com/apache/tomcat/commit/cf9452443bcbf3b1a4b435ef7d624364f1b65ca3",
      "type": "WEB"
    },
    {
      "url": "https://github.com/apache/tomcat/commit/e5cef9618c3f4fd31bd6fb1e83f0f18022280dac",
      "type": "WEB"
    },
    {
      "url": "https://github.com/apache/tomcat/commit/f72a6174ab1f0f5a053435f80448b4f6837fe6d7",
      "type": "WEB"
    },
    {
      "url": "https://github.com/apache/tomcat",
      "type": "PACKAGE"
    },
    {
      "url": "https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r",
      "type": "WEB"
    },
    {
      "url": "https://tomcat.apache.org/security-10.html",
      "type": "WEB"
    },
    {
      "url": "https://tomcat.apache.org/security-11.html",
      "type": "WEB"
    },
    {
      "url": "https://tomcat.apache.org/security-9.html",
      "type": "WEB"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/05/12/13",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "nvd_published_at": "2026-05-12T16:16:17Z",
    "github_reviewed_at": "2026-05-18T20:28:53Z"
  }
}