Live › vulnerability › CVE-2026-101356
Go to dashboardApache Tomcat mishandles object recycling in HTTP/2 processing of asynchronous servlets, so requests and responses can get mixed up between users. An attacker may receive another user's response or have their request answered with someone else's data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the Tomcat version: run catalina.sh version and look for 11.0.22 to 11.0.26, 10.1.55 to 10.1.60, or 9.0.118 to 9.0.122.
Upgrade to Tomcat 11.0.27, 10.1.61, or 9.0.123 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users.
This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122.
Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-101356")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.