CVE-2026-86350

A flaw was found in Apache Tomcat. This vulnerability, identified as HTTP Request/Response smuggling, stems from an inconsistent interpretation of HTTP/2 requests. A regression in a prior security fix can cause request headers to be mixed up. This could allow a remote attacker to bypass security mechanisms or gain unauthorized access to sensitive information.

This vulnerability is rated as having Important impact because unauthenticated remote clients can trigger request desynchronization and header confusion across multiplexed connections, leading to potential access control bypass or data leakage across sessions. Exploitation is limited to instances actively serving HTTP/2 connections, commonly deployed in reverse proxy architectures or direct HTTPS terminations. Instances using standard HTTP/1.1 connector definitions without explicit HTTP/2 protocol upgrade handlers are not exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available.