As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-101356: Apache Tomcat: HTTP/2 request/response mix-up after error during async processing
CVE-2026-101356 is a vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets due to incorrect object recycling and re-use. The flaw can cause request and response mix-up between users. Versions 9.0.118 through 9.0.122, 10.1.55 through 10.1.60, and 11.0.22 through 11.0.26 are affected.
Why it matters: Organizations running vulnerable Tomcat versions with async servlet processing over HTTP/2 risk exposure of user requests and responses to other users; immediate patching is needed.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-101356: Apache Tomcat: HTTP/2 request/response mix-up after error during async processing
Apache Tomcat versions 9.0.118 through 9.0.122, 10.1.55 through 10.1.60, and 11.0.22 through 11.0.26 contain a vulnerability (CVE-2026-101356) in HTTP/2 processing of asynchronous servlets due to incorrect object recycling and re-use. The flaw can cause request and response data to mix between users.
Why it matters: Organizations running affected Tomcat versions on systems handling HTTP/2 traffic face exposure to cross-user data leakage affecting confidentiality and integrity. Upgrading to patched versions is critical to prevent request/response confusion between concurrent users.
- Source published
- First seen by Cybersecurity Tracker