Apache Tomcat: Request/response mix-up in HTTP/2 async processing
Summary
Apache Tomcat mixes up requests and responses between users when an error occurs during asynchronous servlet processing over HTTP/2. This is caused by incorrect recycling and reuse of request and response objects. An unauthenticated remote attacker who sends concurrent HTTP/2 requests may receive or expose other users' response data, and the vendor rates the impact as partial. The default configuration is not affected.
Affected
- Apache Tomcat 11.0.22 to 11.0.26
- Apache Tomcat 10.1.55 to 10.1.60
- Apache Tomcat 9.0.118 to 9.0.122
Fixed in
- Apache Tomcat 11.0.27
- Apache Tomcat 10.1.61
- Apache Tomcat 9.0.123
- Or the fixed package from your distribution or vendor
Workaround
- Disable the HTTP/2 UpgradeProtocol element in the Connector configuration in server.xml (Red Hat recommendation; test first, as this is a service change)
- Or configure affected asynchronous servlets to use synchronous request handling
- A reverse proxy that accepts HTTP/2 from clients and forwards to Tomcat over HTTP/1.1 reduces exposure, provided Tomcat's own HTTP/2 connector is not exposed
Exploitation
- No known exploitation in the wild in the sources reviewed
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial
- No public proof of concept found; this does not prove that none exists
- Scores differ: NVD shows 9.1 (CRITICAL, CISA-ADP), VulDB shows 5.3
Our recommendation
- Inventory all Tomcat instances, including bundled and embedded Tomcat in other products and frameworks
- Upgrade to 11.0.27, 10.1.61 or 9.0.123, or install the fixed distribution package
- Until patched, disable HTTP/2 on internet-facing connectors or move async workloads to synchronous handling
- Review logs for responses that appear to belong to other users
- Ask vendors of Tomcat-based products whether they are affected
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache oss-security advisory www.openwall.com
- Apache Tomcat advisory thread lists.apache.org
- NVD CVE-2026-101356 nvd.nist.gov
- Red Hat CVE record access.redhat.com
- VulDB CVE-2026-101356 vuldb.com
- Apache Tomcat home tomcat.apache.org
- Apache Tomcat release catalogue release-catalog.apache.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:17.
Original description (NVD)
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.