The vulnerability arises from a regression introduced during the remediation of a prior HTTP/2 request smuggling flaw (CVE‑2026‑41293). In Apache Tomcat, the HTTP/2 protocol handler incorrectly parses segment boundaries between incoming request headers and payloads, which can allow crafted streams to alter the effective headers seen by downstream application code. Because of this header mix‑up an attacker could potentially inject or manipulate authentication tokens, session identifiers, or other critical header values, leading to arbitrary access control bypass or unintended data disclosure. The flaw is also related to CWE‑444, which denotes HTTP request smuggling attacks.

Apache Software Foundation: Apache Tomcat is affected. The regression impacts Tomcat releases from 9.0.118 through 9.0.121, from 10.1.55 through 10.1.59, and from 11.0.22 through 11.0.25. The issue was fixed in Tomcat 9.0.122, 10.1.60, and 11.0.26.

The CVSS score of 9.1 indicates a high-severity flaw, and although the vulnerability is not listed in the CISA KEV catalog, the nature of the flaw implies a high exploitation likelihood when an attacker can send arbitrary HTTP/2 requests to the target. The attack vector is remote, does not require authentication, and can lead to significant confidentiality and integrity impacts. Because the bug can be triggered by malformed HTTP/2 stream framing, any exposed Tomcat instance is a potential target until the relevant versions are patched.