Vulnerability Description
Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, from 7.0.83 through 7.0.109. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118, which fix the issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Tomcat | >= 7.0.0, <= 7.0.109 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread/n61zwf75jrv09rz90j4jssncm244bwdbMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/05/12/14Mailing ListThird Party Advisory
FAQ
What is CVE-2026-42498?
CVE-2026-42498 is a vulnerability with a CVSS score of 7.3 (HIGH). Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1....
How severe is CVE-2026-42498?
CVE-2026-42498 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-42498?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Tomcat.