Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

GHSA-R29C-68GH-XP6X Apache Tomcat - HTTP/2 request headers not validated

🗓️ 12 May 2026 18:30:38Reported by GoogleType 
osv
 osv🔗 osv.dev👁 6 Views

Apache Tomcat may mishandle http version two headers due to validation gaps; upgrade to fixed versions.

Related
Refs
ReporterTitlePublishedViews
Family
IBM Security Bulletins		Security Bulletin: Vulnerabilities in Apache Tomcat Server library (CVE-2026-41293, CVE-2026-24880) affect Power HMC.
1 Jul 202616:49
–ibm
IBM Security Bulletins		Security Bulletin: IBM Integration Bus for z/OS is vulnerable to multiple vulnerabilities due to Apache Tomcat
22 Jun 202613:44
–ibm
IBM Security Bulletins		Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerabilities in tomcat-embed-core-11.0.20.jar
17 Jun 202615:33
–ibm
IBM Security Bulletins		Security Bulletin: Maximo AI Service uses cryptography-46.0.6-cp311-abi3-manylinux_2_34_x86_64.whl and tomcat-embed-core-10.1.54.jar which are vulnerable to CVE-2026-39892, CVE-2026-41293, CVE-2026-43512, CVE-2026-43513 and CVE-2026-43515.
30 Jun 202607:44
–ibm
IBM Security Bulletins		Security Bulletin: The Apache Tomcat application server that is shipped with IBM ApplinX is vulnerable to multiple vulnerabilities.
16 Jun 202617:54
–ibm
IBM Security Bulletins		Security Bulletin: Multiple Vulnerabilities in IBM DevOps Build.
29 Jun 202615:52
–ibm
IBM Security Bulletins		Security Bulletin: Multiple vulnerabilities in IBM DevOps Solution Workbench
25 Jun 202616:30
–ibm
IBM Security Bulletins		Security Bulletin: Multiple Vulnerabilities in IBM DataStax Enterprise
29 Jun 202609:47
–ibm
Tenable Nessus		Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2026-1770)
8 Jun 202600:00
–nessus
Tenable Nessus		Amazon Linux 2023 : tomcat10, tomcat10-admin-webapps, tomcat10-el-5.0-api (ALAS2023-2026-1776)
8 Jun 202600:00
–nessus
Rows per page
SourceLink
nvdwww.nvd.nist.gov/vuln/detail/CVE-2026-41293
githubwww.github.com/apache/tomcat/commit/19f17a257797e8d139b33ff9c88d362a273be148
githubwww.github.com/apache/tomcat/commit/1c70480466572c9192ed412ebefcd43fc63137fd
githubwww.github.com/apache/tomcat/commit/2a2476460e823789f530a22207873ea8cd6eff3b
githubwww.github.com/apache/tomcat/commit/3915fd27e6810b14ccd21e3d900bd8faef44d3df
githubwww.github.com/apache/tomcat/commit/57c2b3bfd62792631e1df24cf4237b990a0b36fa
githubwww.github.com/apache/tomcat/commit/c2925554c677da57390f940d856871e18daaacab
githubwww.github.com/apache/tomcat/commit/cf9452443bcbf3b1a4b435ef7d624364f1b65ca3
githubwww.github.com/apache/tomcat/commit/e5cef9618c3f4fd31bd6fb1e83f0f18022280dac
githubwww.github.com/apache/tomcat/commit/f72a6174ab1f0f5a053435f80448b4f6837fe6d7
Rows per page

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
19 May 2026 20:44Current
5.8Medium risk
Vulners AI Score5.8
CVSS 3.19.8
EPSS0.01339
apache tomcathttp two headersheader validation
6