CVE-2026-41293

Apache Tomcat did not validate HTTP/2 request headers, triggering unexpected application behavior, as applications may presume that header values exposed through the Servlet API would be valid.

This vulnerability is rated Moderate severity for Red Hat products because triggering the issue requires HTTP/2 protocol support to be explicitly enabled on the Tomcat connector, which is not the standard default. Although malformed incoming header data may reach downstream servlets without expected validation checks, the flaw does not directly compromise the host system or grant remote code execution. The overall blast radius is limited to unexpected behavior in specific web applications that rely entirely on the servlet container for request header sanitation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.