CVE-2026-86350: Apache Tomcat, HTTP/2 header mix-up

Invalid HTTP/2 fields abort HPACK decode before they enter the dynamic table. The next stream on the connection interprets indexes against a desynced table. HTTP/1.1 does not reach this decoder.

Name: CVE-2026-86350: Apache Tomcat, HTTP/2 header mix-up
Type: N-day analysis
CVE: CVE-2026-86350
CVE Risk: critical
Disclosure Status: public
Vendor: Apache Software Foundation
Affected: Apache Tomcat 9.0.121, and the listed 10.1.55-59 and 11.0.22-25 ranges. Patched in 9.0.122, 10.1.60, and 11.0.26.
Published: 28 Oct 2026
Updated: 28 Oct 2026
Tags: n-day, tomcat, http2, cwe-444

Apache Tomcat, HTTP/2 header mix-up

Apache Tomcat 9.0.121 - Apache Software Foundation

I am @abraxas_null. Loopback lab. The client is CVE-2026-86350-Abraxas-Labs.py.

HTTP/2 header mix-up. A regression in the CVE-2026-41293 HPACK validation refactor: invalid fields abort decode so later fields never enter the dynamic table. The next stream on the connection then interprets indexes against a desynced table. 9.0.121 (also 10.1.55-59, 11.0.22-25). Fixed in 9.0.122 / 10.1.60 / 11.0.26 by reverting early validation.

CVE-2026-86350 (NVD). CWE-444. Vendor: Apache Software Foundation. Apache Tomcat 9.0.121, and the listed 10.1.55-59 and 11.0.22-25 ranges. Patched in 9.0.122, 10.1.60, and 11.0.26.

What an attacker can do

Unauthenticated HTTP/2. Send a HEADERS block with an invalid field, then a second stream on the same connection. Headers mix, or the connection GOAWAYs / RSTs. That is request smuggling against anything sitting behind this connector. HTTP/1.1 only is not this CVE.

How this showed up in the lab

I mapped HpackDecoder / HPackHuffman on 9.0.121, then hit h2c with prior-knowledge preface. Stream 1: invalid field value (trailing space) then a marker. Stream 2 indexes the marker.

Fail-controls already in the lab: stream 1 RST and stream 2 clean 200 is patched 9.0.122; HTTP/1.1 only never reaches the decoder; a reverse shell is not this CVE. Apache also lists removing the examples webapp as a mitigation for the header oracle, not as a patch.

The lab

Port 18095. Tomcat 9.0.121, HTTP/2 enabled, examples webapp present for the header oracle.

Target only 127.0.0.1:18095 (or the loopback you bound).

Plain text

cd lab
docker compose up --force-recreate
python3 ../CVE-2026-86350-Abraxas-Labs.py