CVE-2026-41293

Published: May 12, 2026Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Affected (5)

Products: Apache: Tomcat

Apache

1 product

Tomcat

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	From 10.0.0 to 10.0.27
Apache Tomcat	From 10.1.0 to 10.1.55
Apache Tomcat	From 11.0.0 to 11.0.22
Apache Tomcat	From 8.5.0 to 8.5.100
Apache Tomcat	From 9.0.0 to 9.0.118

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2026/05/12/13

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.