CVE-2026-41293

The vulnerability results from the lack of proper verification of user-supplied input data to the Apache Tomcat server. An attacker can send an appropriately crafted network request without the need for authentication or user interaction. The attack vector is network-based, and attack complexity is low, making the vulnerability exceptionally easy to exploit.

Successful exploitation of this vulnerability may result in complete loss of confidentiality, integrity, and availability of the system — an attacker can gain unauthorized access to data, modify server content, or cause its unavailability.

Apply patches available from the vendor according to the references (the target fixed version was not explicitly indicated in the description — it is recommended to verify the Apache mailing list and official vendor references). In the meantime, it is worth considering restricting network access to the Tomcat server using a firewall.

Apache Tomcat in versions: from 11.0.0-M1 to 11.0.21, from 10.1.0-M1 to 10.1.54, from 9.0.0.M1 to 9.0.117, from 10.0.0-M1 to 10.0.27. Older, unsupported versions may also be vulnerable.