CVE-2026-101356: Apache Tomcat: HTTP/2 request/response mix-up after error during async processing
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/tomcatto a version that resolves this vulnerability.Fixed in 9.0.123 - Upgrade
Upgrade
bitnami/tomcatto a version that resolves this vulnerability.Fixed in 10.1.61 - Upgrade
Upgrade
bitnami/tomcatto a version that resolves this vulnerability.Fixed in 11.0.27 - Upgrade
Upgrade
debian/tomcat9to a version that resolves this vulnerability.Fixed in 9.0.70-2Fixed in 9.0.95-1Fixed in 9.0.122-1 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.27 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.61 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.123
Event History
Frequently Asked Questions
Which Tomcat releases need to be remediated?
Affected releases are 11.0.22 through 11.0.26, 10.1.55 through 10.1.60, and 9.0.118 through 9.0.122. Upgrade to 11.0.27, 10.1.61, or 9.0.123 respectively.
What conditions are involved in triggering the issue?
The issue involves HTTP/2 processing for asynchronous servlets and occurs after an error during asynchronous processing. Incorrect recycling and reuse of objects can then cause requests and/or responses to be mixed up between users.