Incorrect Object Recycling in Apache Tomcat Affects HTTP/2 Processing
CVE-2026-101356

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Tomcat
Vendor
CVE Published:
20 October 2026

What is CVE-2026-101356?

The vulnerability in Apache Tomcat involves improper recycling and re-use of objects in HTTP/2 processing related to asynchronous servlets, which can lead to unintended mixing of requests and responses between different users. This can result in sensitive data exposure and potential session hijacking if exploited. Users of affected versions are strongly advised to upgrade to the latest versions to mitigate this risk.

Affected Version(s)

Apache Tomcat 11.0.22 <= 11.0.26

Apache Tomcat 10.1.55 <= 10.1.60

Apache Tomcat 9.0.118 <= 9.0.122

References

https://lists.apache.org/thread.html/d1xjt7bbjqw7y7n5mcb4...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.