Paper/Archive/CVE-2026-101356

CVE-2026-101356

Apache Software Foundation Apache Tomcat — Apache Tomcat: HTTP/2 request/response mix-up after error during async processing

EPSS 0.5%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (ADP)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 42.7.427 × 208.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.

Affected

ProductAffectedFixed inSource

Apache Tomcat11.0.22 – 11.0.26–CNA

Apache Tomcat10.1.55 – 10.1.60–CNA

Apache Tomcat9.0.118 – 9.0.122–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

advisorylists.apache.org/thread.html/d1xjt7bbjqw7y7n5mcb4fm815hpfgc27 refopenwall.com/lists/oss-security/2026/10/20/27