Apache Tomcat HTTP/2 Async Patch Fixes CVE-2026-101356 Request Mix-Up
A vulnerability in Apache Tomcat allows mixed HTTP/2 requests between users during asynchronous processing. Affected versions require immediate upgrade to 11.0.27, 10.1.61 or 9.0.123.
Key points
- CVE-2026-101356 allows request and response mix-ups between users in Apache Tomcat.
- The flaw affects Tomcat versions 11.0.22-11.0.26, 10.1.55-10.1.60 and 9.0.118-9.0.122.
- Upgrades to 11.0.27, 10.1.61 or 9.0.123 resolve the incorrect object recycling issue.
Apache Tomcat contains a vulnerability that causes HTTP/2 requests and responses to mix between different users. This flaw occurs during the processing of asynchronous servlets. The National Vulnerability Database rates CVE-2026-101356 as critical with a CVSS score of 9.1. The issue stems from incorrect object recycling and reuse within the server software.
The risk
The vulnerability allows data leakage by mixing user requests. An attacker could potentially intercept or view data intended for another user. This happens because the server incorrectly recycles objects during asynchronous processing. The flaw specifically impacts HTTP/2 traffic handling. Security researchers note that this can trigger request and response mix-ups between users.
Who is exposed
Apache Tomcat versions 11.0.22 through 11.0.26 are affected by this issue. Versions 10.1.55 through 10.1.60 also contain the vulnerability. Additionally, Tomcat 9.0.118 through 9.0.122 are exposed to this risk. Organizations using these specific version ranges must take action. The Apache Software Foundation maintains the affected software.
Cost and compliance
The National Vulnerability Database assigns a CVSS score of 9.1 to CVE-2026-101356. This rating classifies the vulnerability as critical. The flaw allows for request and response mix-ups between users. No financial penalties or regulatory fines are mentioned in the source material. Compliance teams should note the critical severity rating.
What to watch
Teams should verify their current Apache Tomcat version immediately. Check if the version falls within the affected ranges. Monitor for any unusual HTTP/2 traffic patterns. Ensure that upgrades to the fixed versions are planned. The vendor has released patches for all affected branches.
Signals worth monitoring
Security teams usually review access logs for anomalies in request routing. Look for responses that do not match the originating request context. Check for data appearing in sessions that belong to other users. Monitor for unusual asynchronous servlet behavior. Verify that object recycling is functioning correctly. Ensure that HTTP/2 stream handling is isolated per user. Review server error logs for processing failures.
What to do and how to stay safe: Apache Tomcat
- Upgrade Apache Tomcat to version 11.0.27, 10.1.61 or 9.0.123.
- Audit all servers running Tomcat versions 11.0.22-11.0.26, 10.1.55-10.1.60 and 9.0.118-9.0.122.
- Monitor HTTP/2 traffic for signs of request mixing between users.
- Review asynchronous servlet configurations for potential exposure.
Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First
General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Apache Tomcat versions are affected by CVE-2026-101356?
Versions 11.0.22 through 11.0.26, 10.1.55 through 10.1.60 and 9.0.118 through 9.0.122 are affected.
What is the CVSS score for this vulnerability?
The National Vulnerability Database rates CVE-2026-101356 as critical with a CVSS score of 9.1.
How can organizations fix this issue?
Users should upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.
