Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-86350 — Disclosure pack and PoC for CVE-2026-86350, an unauthenticated HTTP/2 request header mix-up (CWE-444) in Apache Tomcat 9.0.121, with lab reproduction and patch guidance. | Kitploit
Tools/GitHubGitHub/abraxas/cve-2026-86350
Vulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityPenetration TestingLabs & Practice
GitHubabraxas/cve-2026-86350

CVE-2026-86350

Disclosure pack and PoC for CVE-2026-86350, an unauthenticated HTTP/2 request header mix-up (CWE-444) in Apache Tomcat 9.0.121, with lab reproduction and patch guidance.

View Repository
21 day agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Abraxas Labs — CVE-2026-86350

abraxaslabs.tech  ·  github.com/abraxas  ·  @abraxas_null  ·  CVE-2026-86350

CVE-2026-86350

Apache Tomcat 9.0.121 — Apache Software Foundation

Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up.

CVECVE-2026-86350 · CVE.org
CWECWE-444
CVSSCritical: 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
ProductApache Tomcat
Affectedall versions through 9.0.121 (inclusive)
Patched9.0.122 and later
Authunauthenticated (see source map)
LicenseGNU Affero GPL v3.0
Lab127.0.0.1 only · vendor/client disclosure pack, not a scanner

Advisory (from the source map)

java/org/apache/coyote/http2/HpackDecoder.java and HPackHuffman.java. Patch 9.0.122 commit 5adadc4e / 11.0.26 192bc749 reverts early validation.

Entry

  • Method: GET
  • Path: /header.jsp
  • Router: Unauthenticated HTTP/2 HEADERS. HpackDecoder/HPackHuffman validate during decode (CVE-2026-41293 refactor). Invalid field throws; later fields skip the dynamic table.
  • Notes: Unauthenticated CVE-2026-86350 CWE-444 Tomcat 9.0.121. Witness: second stream on the same connection GOAWAY/RST or mixed headers after an invalid field. Not a reverse shell.

Call chain

  • HTTP/2 prior-knowledge preface to :8080 UpgradeProtocol Http2Protocol
  • HEADERS stream 1: invalid field value trailing space then x-lab-witness
  • HpackDecoder.readHpackString throws IllegalArgumentException mid-block
  • dynamic table missing the marker; stream 2 indexes the marker
  • decoder mix-up or COMPRESSION_ERROR / GOAWAY

Lab preconditions

  • Tomcat 9.0.118-9.0.121 or 10.1.55-59 or 11.0.22-25
  • HTTP/2 enabled (h2 or h2c)
  • examples webapp present for the header oracle (Apache also lists removing examples as a mitigation)

Witness

After invalid HTTP/2 field on stream 1, stream 2 is not a clean 200 (GOAWAY, RST, or marker mix-up).

Not success

  • stream 1 RST and stream 2 200 (patched 9.0.122 behavior)
  • HTTP/1.1 only
  • reverse shell

Patch / remediation

Do this first: Update Apache Tomcat to 9.0.122 or newer.

Verify after upgrade

  • Re-run CVE-2026-86350-Abraxas-Labs.py against the patched build: the mapped witness must not appear.
  • Confirm the vendor advisory / changeset in the deployed tree (see references).
  • A WAF signature is delay, not a patch.

If you cannot update immediately

  • Disable or isolate the affected component.
  • Hunt for the witness condition on production (new privileged users, unexpected files, injected rows — whatever this CVE's map names).

Reproduction (authorized lab)

Target only http://127.0.0.1:8088 (or the loopback you bound). Do not point this script at the internet.

root@kitploit:~
python3 CVE-2026-86350-Abraxas-Labs.py

Success is the witness above in the response body. Generic 200 HTML is not it.

Lab images

Loopback stack used to reproduce. Official images unless a Dockerfile in this folder builds from source.

  • lab/docker-compose.yml
  • lab/Dockerfile
root@kitploit:~
cd lab
docker compose up --force-recreate

Bind the vulnerable product tree next to Compose if the YAML mounts a local directory (plugin zip / source tag from the version table). Publish nothing except 127.0.0.1.

References

  • CVE-2026-86350 · NVD

  • CVE-2026-86350 · CVE.org

  • tomcat.apache.org/security-9.html

  • lists.apache.org/thread/mss45z99lcdd5dtpgcn45dy82f3toswc

  • www.cve.org/CVERecord?id=CVE-2026-86350

  • github.com/apache/tomcat/commit/5adadc4ef413d5050f664d40800bbff74bd5d5ed

  • Abraxas Labs: abraxaslabs.tech · github.com/abraxas · @abraxas_null

Records (structured)

root@kitploit:~
# CVE-2026-86350

CWE: CWE-444
CVSS: Critical 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (CISA-ADP). Apache: Important.

## Description

A regression in the CVE-2026-41293 HTTP/2 header-validation refactor can mix request headers. Invalid HPACK fields abort decode so later fields never enter the dynamic table; the next stream on the connection then interprets indexes against a desynced table.

## Product

Apache Tomcat 9.0.121 (fixed in 9.0.122; also 10.1.60 and 11.0.26). Lab oracle is HPACK desync, not RCE.

License

This disclosure pack is licensed under the GNU Affero General Public License v3.0. See LICENSE.

Disclaimer

This pack is for the vendor, the site owner, and licensed labs. The script talks to 127.0.0.1. Using it against systems you do not own is not authorized by Abraxas Labs. No warranty.

abraxaslabs.tech · github.com/abraxas · @abraxas_null

Download Tool