CVE-2026-101356
published 2026-10-20CVE-2026-101356: Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response…
PriorityP261critical9.1CVSS 3.1
AVNACLPRNUINSUCHINAH
EPSS
0.50%
42.5th percentile
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users.
This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122.
Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache_software_foundation | apache_tomcat | 10.1.55 – 10.1.60 | — |
| apache_software_foundation | apache_tomcat | 11.0.22 – 11.0.26 | — |
| apache_software_foundation | apache_tomcat | 9.0.118 – 9.0.122 | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vendor_redhat9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing
vendor_redhat·2026-10-20·CVSS 9.1
CVE-2026-101356 [CRITICAL] CWE-488 tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing
tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing
A flaw was found in Apache Tomcat. Incorrect object recycling and reuse during the HTTP/2 processing of asynchronous servlets can cause requests and responses to be mixed up between different users. A remote attacker could exploit this vulnerability to trigger unintended data cross-over, potentially leading to information disclosure.
GHSA
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users.
ghsa_unreviewed·2026-10-20
CVE-2026-101356 [CRITICAL] CWE-362 Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users.
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users.
This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122.
Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-101356 tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing [fedora-44]
bugzilla·2026-10-21·CVSS 9.1
CVE-2026-101356 [CRITICAL] CVE-2026-101356 tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing [fedora-44]
CVE-2026-101356 tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users.
This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122.
Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.
Bugzilla
CVE-2026-101356 tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing [fedora-43]
bugzilla·2026-10-21·CVSS 9.1
CVE-2026-101356 [CRITICAL] CVE-2026-101356 tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing [fedora-43]
CVE-2026-101356 tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users.
This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122.
Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.
Bugzilla
CVE-2026-101356 tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing [fedora-rawhide]
bugzilla·2026-10-21·CVSS 9.1
CVE-2026-101356 [CRITICAL] CVE-2026-101356 tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing [fedora-rawhide]
CVE-2026-101356 tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users.
This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122.
Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.
Bugzilla
CVE-2026-101356 tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing
bugzilla·2026-10-20·CVSS 9.1
CVE-2026-101356 [CRITICAL] CVE-2026-101356 tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing
CVE-2026-101356 tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users.
This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122.
Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.
2026-10-20
Published