Apache Tomcat HTTP/2 Request Header Validation Flaw

Successful exploitation may cause unexpected application behavior in software deployed behind affected Tomcat instances when that software relies on Servlet API header values being valid and specification compliant. Available information characterizes the issue as low severity. Broader downstream advisories group this flaw with Tomcat issues that may contribute to denial of service, authentication bypass, or disclosure of sensitive information depending on application-specific handling, but the specific documented impact for this CVE is exposure of invalid header values leading to unintended application behavior.

If immediate patching is not possible, reduce exposure by limiting or disabling HTTP/2 where operationally feasible, placing affected services behind intermediaries that enforce strict HTTP/2 header compliance, and hardening applications so they do not assume request header values obtained through the Servlet API are already specification compliant. Validate and sanitize header values in application code before security-sensitive use. These measures are compensating controls and do not replace upgrading.

Upgrade Apache Tomcat to a fixed release on the relevant supported branch. Reported fixed versions are Tomcat 11.0.22 or later, 10.1.55 or later, and 9.0.118 or later. For affected 10.0.x deployments, move to a supported fixed branch because 10.0.x is end of support. Older unsupported versions should also be assumed potentially affected and upgraded to a supported release line.