StackRadar

CVE-2026-41293

Critical

Advisory

Published 12 May 2026In the index since 5 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.016
74th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
301
of 17,781 indexed, latest versions
Container images
258
deployed by those charts
Fix available
4 of 4
affected packages

Apache Tomcat: HTTP/2 request headers not validated

Carried by container images the latest versions of 301 of 17,781 indexed charts deploy, on 258 images.

Affected packageAffected versionsFixed inImages
tomcat-embed-coremaven8.5.4, 8.5.11, 8.5.14, 8.5.15+79 more9.0.118, 10.1.55, 11.0.22238
tomcat-coyotemaven8.5.38, 8.5.41, 8.5.43, 8.5.57+17 more9.0.118, 10.1.55, 11.0.2224
Apache Tomcatbitnami9.0.8010.1.551
tomcatbitnami9.0.80-110.1.551
OSV records
BIT-tomcat-2026-41293GHSA-r29c-68gh-xp6x

Charts affected

301 by stars
ChartLatestAffected imagesRadar Score
zahori-serverzahoriVerified publisher1.0.11 of 2See more

zahori-server zahori 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-41293.

Container imageDigestPackageFixed in
zahoriaut/zahori-server:0.1.17b2de13916f3e
tomcat-embed-core@9.0.71
9.0.118

Open the chart page →

5,846

Container images carrying it

258 by charts deploying them

A fixed version is listed for 4 of the 4 affected packages.

Container imageDigestPackageFixed inUsed by
geoservercloud/geoserver-cloud-wcs:1.0-RC247ae1bdb4bcc
tomcat-embed-core@9.0.37
9.0.118
1
geoservercloud/geoserver-cloud-webui:1.0-RC228c3e5a8c5a3
tomcat-embed-core@9.0.37
9.0.118
1
geoservercloud/geoserver-cloud-wfs:1.0-RC28c70ee06d5ab
tomcat-embed-core@9.0.37
9.0.118
1
geoservercloud/geoserver-cloud-wms:1.0-RC242775ba6a4da
tomcat-embed-core@9.0.37
9.0.118
1
golenski/fibonacci-msg-relay:1.0.0c863dcb0c513
tomcat-embed-core@10.1.31
10.1.55
1
golenski/fibonacci-task-manager:2.0.03a2b36df247b
tomcat-embed-core@10.1.31
10.1.55
1
golenski/fibonacci-worker:2.0.0954caf4aaf6a
tomcat-embed-core@10.1.31
10.1.55
1
gotson/komga:0.99.49b15ea6bfc30
tomcat-embed-core@9.0.46
9.0.118
1
gotson/komga:1.22.0ba892ab3e082
tomcat-embed-core@10.1.33
10.1.55
1
gresearchdev/siembol-config-editor-rest:latest91863a50afb7
tomcat-embed-core@9.0.68
9.0.118
1
gresearchdev/siembol-storm-topology-manager:latest8dad36a05ebf
tomcat-embed-core@9.0.68
9.0.118
1
guacamole/guacamole:1.5.50f62f6d17ab3
tomcat-coyote@8.5.98
9.0.118
1
guacamole/guacamole:1.1.0333a7f40c145
tomcat-coyote@8.5.41
9.0.118
1
guacamole/guacamole:1.3.0739cb6820ae8
tomcat-coyote@8.5.61
9.0.118
1
gurolakman/smsf-configuration:1.0.49abb3882bcbd
tomcat-embed-core@9.0.60
9.0.118
1
gurolakman/smsf-momt:1.0.4ce23b20a8a17
tomcat-embed-core@9.0.60
9.0.118
1
gurolakman/smsf-registration:1.0.4b22e746edd5d
tomcat-embed-core@9.0.60
9.0.118
1
gurolakman/ussigw-configuration:1.0.4bf18525c5ad9
tomcat-embed-core@9.0.60
9.0.118
1
gurolakman/ussigw-core:1.0.48739565c3ea2
tomcat-embed-core@9.0.60
9.0.118
1
hmediade/printserver:latest481a552c8e1c
tomcat-coyote@9.0.85
9.0.118
1
housewrecker/gaps:latestf417dd0a7547
tomcat-embed-core@9.0.60
9.0.118
1
huajuan6848/env-view-server:0.0.1-SNAPSHOTa303f3d9f6e0
tomcat-embed-core@10.1.11
10.1.55
1
ibmcom/microclimate-file-watcher:latestab3fd1fdfa18
tomcat-embed-core@8.5.15
9.0.118
1
ibmcom/microclimate-theia:lateste17bdccc5030
tomcat-embed-core@8.5.15
9.0.118
1
intelloop/atlas-cmms-backend:v1.5.14c61bc3dd3f8
tomcat-embed-core@10.1.19
10.1.55
1
j4ckhunter/consumer:1.00bb7a429e3e75
tomcat-embed-core@9.0.65
9.0.118
1
j4ckhunter/producer:1.006ba447609b12
tomcat-embed-core@9.0.65
9.0.118
1
jacobalberty/unifi:v7.1.664a3616625dda
tomcat-embed-core@9.0.58
9.0.118
1
jacobalberty/unifi:v7.4.162b3edc809a3ff
tomcat-embed-core@9.0.65
9.0.118
1
jacobalberty/unifi:5.10.19c409924e2463
tomcat-embed-core@8.5.34
9.0.118
1
javaaurelio/dadosfake_web_springboot:latest8541a3cd021a
tomcat-embed-core@10.1.15
10.1.55
1
just1not2/streama:1.10.48a2305192dec
tomcat-embed-core@8.5.11
9.0.118
1
kimb88/hello-world-spring-boot:latest0639155241cb
tomcat-embed-core@8.5.32
9.0.118
1
krontechnology/aapm-agent:1.1.07feef7d2ab42
tomcat-embed-core@9.0.39
9.0.118
1
kubebb/gateway-api:v5.6.04d062f20309c
tomcat-embed-core@9.0.65
9.0.118
1
kubebb/mesh-api:v5.7.0a3879931dfa1
tomcat-embed-core@10.1.12
10.1.55
1
kvalitetsit/stakit-backend:0.3.0f0af0ba589af
tomcat-embed-core@10.1.24
10.1.55
1
ladeit/ladeit:latest962b665ffe82
tomcat-embed-core@9.0.13
9.0.118
1
lavandadelpatio/automated-download-films:0.0.2094e225a5a6f8
tomcat-embed-core@9.0.38
9.0.118
1
lavandadelpatio/automated-download-shows:0.0.492de3c3426d2
tomcat-embed-core@9.0.38
9.0.118
1
lavandadelpatio/filebot:0.0.671f2ccec8c0d
tomcat-embed-core@9.0.44
9.0.118
1
lavandadelpatio/filebot-bot:0.0.1-SNAPSHOTd2cba20aa4d8
tomcat-embed-core@9.0.56
9.0.118
1
lavandadelpatio/tmdb:latestded9377636e9
tomcat-embed-core@10.1.15
10.1.55
1
lavandadelpatio/tmdb:0.0.2f36af885e915
tomcat-embed-core@9.0.44
9.0.118
1
lavandadelpatio/torznab-atomohd:latest214eaef5444c
tomcat-embed-core@10.1.7
10.1.55
1
library/sonarqube:6.7.6-community0ae5169e3d0f
tomcat-embed-core@8.5.23
9.0.118
1
library/sonarqube:8.2-communitya246bc64207e
tomcat-embed-core@8.5.41
9.0.118
1
library/tomcat:8.5.41-alpine04feaf74f8bb
tomcat-coyote@8.5.41
9.0.118
1
linuxserver/airsonic-advanced:11.1.4d286a7f55a59
tomcat-embed-core@10.1.28
10.1.55
1
linuxserver/unifi-controller:8.0.240ae315a3a456
tomcat-embed-core@9.0.65
9.0.118
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.