CVE-2026-41293: Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 th

Q: How do I fix CVE-2026-41293?

tomcat: upgrade to 9.0.118, 10.1.55, 11.0.22. Exact commands for each OS are on this page.

Q: Is CVE-2026-41293 being exploited?

CVE-2026-41293 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2026-41293 affect?

CVE-2026-41293 affects tomcat. Severity is critical (CVSS 9.8). Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of suppor

Q: How urgent is CVE-2026-41293?

Priority 67/100. Critical severity; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action; On your watchlist

This week

CRITICAL 9.8REMOTEWATCHLISTUPGRADE

CVE-2026-41293 is a critical-severity flaw (CVSS 9.8) affecting tomcat. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Why this priority

Critical severity
CISA SSVC: automatable with total technical impact
Remotely exploitable, no login, no user action
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	1.7% (top 23%)
CISA exploited list	No
Weakness	CWE-20
Published	2026-05-12
Last modified	2026-10-26

Publisher (CNA): Apache Software Foundation · Vendor: apache

Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-05-12 16:16 UTCPublished CVE record published
2026-10-26 18:10 UTCUpdated Record last modified

apache tomcat UPGRADE

Affected: >= 8.5.0 and <= 8.5.100 · >= 9.0.0 and < 9.0.118 · >= 10.0.0 and <= 10.0.27 · >= 10.1.0 and < 10.1.55 · >= 11.0.0 and < 11.0.22

Fixed in: 9.0.118, 10.1.55, 11.0.22

Safe to downgrade to: a release before 8.5.0

1. Check installed version

apt-cache policy tomcat || rpm -q tomcat || tomcat --version

2. UPGRADE to 9.0.118 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade tomcat

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade tomcat

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 8.5.0 (Debian / Ubuntu)

apt-cache madison tomcat sudo apt install tomcat=<VERSION_BEFORE_8.5.0> sudo apt-mark hold tomcat

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list tomcat sudo dnf downgrade tomcat-<VERSION_BEFORE_8.5.0> sudo dnf versionlock add tomcat

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

Maven · org.apache.tomcat.embed:tomcat-embed-core · FIXED · 10.1.55 · vulnerable: >= 10.1.0-M1, < 10.1.55 · source

Set org.apache.tomcat.embed:tomcat-embed-core to 10.1.55 or later in pom.xml or build.gradle, then rebuild and redeploy.

Maven · org.apache.tomcat:tomcat · FIXED · 10.1.55 · vulnerable: >= 10.1.0-M1, < 10.1.55 · source

Set org.apache.tomcat:tomcat to 10.1.55 or later in pom.xml or build.gradle, then rebuild and redeploy.

Fedora ELN · xfsdump · FIXED · 3.3.0-3.eln159 · FEDORA-2026-6e9bb3f901 · source

sudo dnf upgrade --advisory=FEDORA-2026-6e9bb3f901

Fedora 46 · fio · FIXED · 3.43-2.fc46 · FEDORA-2026-b36219886b · source

sudo dnf upgrade --advisory=FEDORA-2026-b36219886b

Debian 12 · tomcat10 · FIXED · 10.1.55-1~deb12u1

sudo apt update && sudo apt install --only-upgrade tomcat10 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' tomcat10)" ge "10.1.55-1~deb12u1" && echo PATCHED || echo STILL-VULNERABLE

Debian 13 · tomcat10 · FIXED · 10.1.55-1~deb13u1

sudo apt update && sudo apt install --only-upgrade tomcat10 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' tomcat10)" ge "10.1.55-1~deb13u1" && echo PATCHED || echo STILL-VULNERABLE

Debian 13 · tomcat11 · FIXED · 11.0.22-1~deb13u1

sudo apt update && sudo apt install --only-upgrade tomcat11 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' tomcat11)" ge "11.0.22-1~deb13u1" && echo PATCHED || echo STILL-VULNERABLE

Debian 12 · tomcat9 · FIXED · 9.0.70-2

sudo apt update && sudo apt install --only-upgrade tomcat9 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' tomcat9)" ge "9.0.70-2" && echo PATCHED || echo STILL-VULNERABLE

RHEL 10 · tomcat9 · FIXED · tomcat9-9.0.120-1.el10_2

sudo dnf upgrade --advisory=RHSA-2026:68651 rpm -q tomcat9

RHEL 10 · tomcat · FIXED · tomcat-10.1.49-4.el10_2

sudo dnf upgrade --advisory=RHSA-2026:69259 rpm -q tomcat

RHEL 10.0 Extended Update Support · tomcat9 · FIXED · tomcat9-9.0.120-1.el10_0

sudo dnf upgrade --advisory=RHSA-2026:67163 rpm -q tomcat9

RHEL 10.0 Extended Update Support · tomcat · FIXED · tomcat-10.1.49-1.el10_0

sudo dnf upgrade --advisory=RHSA-2026:67164 rpm -q tomcat

RHEL 8 · tomcat · FIXED · tomcat-9.0.120-1.el8_10

sudo dnf upgrade --advisory=RHSA-2026:68677 rpm -q tomcat

Amazon Linux 2023 · see advisory · FIXED · ALAS2023-2026-1776 · source

sudo dnf update --advisory=ALAS2023-2026-1776

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

GitHub PoC: xiaoqiMikko/tomcat-check (0 stars)

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-41293?

tomcat: upgrade to 9.0.118, 10.1.55, 11.0.22. Exact commands for each OS are on this page.

Is CVE-2026-41293 being exploited?

CVE-2026-41293 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-41293 affect?

CVE-2026-41293 affects tomcat. Severity is critical (CVSS 9.8). Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of suppor

How urgent is CVE-2026-41293?

Priority 67/100. Critical severity; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action; On your watchlist

Software pages

Apache Tomcat vulnerabilities

Related CVEs

CVE-2026-43515 CRITICAL 9.1 UPGRADE Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same exten
CVE-2026-41284 HIGH 7.5 UPGRADE Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apach
CVE-2026-42498 HIGH 7.3 UPGRADE Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Ap
CVE-2026-43513 HIGH 7.5 UPGRADE Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apac
CVE-2026-43514 LOW 3.7 UPGRADE Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Ap

References

← Back to latest CVEs