CVE-2026-86350

Summary

This flaw involves an inconsistent interpretation of HTTP/2 requests, leading to potential request header mix-ups, which can be exploited to manipulate HTTP requests and responses.

Exploitability

Exploitation is moderately difficult and requires the attacker to send specific HTTP/2 requests that trigger the vulnerability. Precondition is the presence of affected Apache Tomcat versions.

Blast radius

If exploited, this could lead to unauthorized access or manipulation of HTTP requests and responses, potentially leading to data leakage or other security breaches.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Apache Tomcat version 11.0.26, 10.1.60, or 9.0.122.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.