Skip to content
Fencer Intel
critical 9.1

CVE-2026-101356 json

Apache Tomcat: HTTP/2 request/response mix-up after error during async processing

published 20d ago modified 11d ago also BIT-tomcat-2026-101356 , EUVD-2026-105011

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 43%
public exploits
0
none known

Summary

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users.

This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122.

Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.

Patch / fix

  • bitnami tomcat 9.0.123, 10.1.61, 11.0.27
  • tomcat9 Debian 14, Debian 13, Debian 12 9.0.70-2

debian advisories DEBIAN-CVE-2026-101356

  • tomcat SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 9.0.123-150200.126.1
  • tomcat10 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES 15 SP6-LTSS +4 more 10.1.61-150200.5.85.1
  • tomcat SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 9.0.123-3.182.2
  • libapr1 SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 1.6.5-4.13.1
  • libtcnative-1-0 SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 1.3.9-3.9.1

suse advisories SUSE-SU-2026:5116-1SUSE-SU-2026:5073-1SUSE-SU-2026:4927-1

  • tomcat openSUSE Tumbleweed 9.0.123-1.1
  • tomcat10 openSUSE Tumbleweed 10.1.61-1.1
  • tomcat11 openSUSE Tumbleweed 11.0.27-1.1

opensuse advisories openSUSE-SU-2026:12254-1openSUSE-SU-2026:12255-1openSUSE-SU-2026:12256-1

Is CVE-2026-101356 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-101356 updated cvss 5.3

tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing

  • Red Hat Enterprise Linux 8 tomcat, tomcat-lib, tomcat-webapps, tomcat-el-3.0-api, tomcat-docs-webapp, tomcat-jsp-2.3-api, +2 more Red Hat Enterprise Linux 9 tomcat, tomcat-lib, tomcat-webapps, tomcat-el-3.0-api, tomcat-docs-webapp, tomcat-jsp-2.3-api, +2 more Red Hat Enterprise Linux 10 tomcat9
    affected: workaround, no fix available “Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling.”
  • Red Hat Hardened Images tomcat10 10.1.61-0.1.hum1, tomcat11 11.0.27-0.1.hum1, tomcat10-lib 10.1.61-0.1.hum1, tomcat11-lib 11.0.27-0.1.hum1, tomcat10-common 10.1.61-0.1.hum1, tomcat11-common 11.0.27-0.1.hum1, +14 more
    fixed: vendor fix “Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling.” RHSA-2026:85926
  • Red Hat Enterprise Linux 6 tomcat6, tomcat6-lib, tomcat6-log4j, tomcat6-javadoc, tomcat6-webapps, tomcat6-el-2.1-api, +4 more Red Hat Enterprise Linux 7 tomcat, tomcat-lib, tomcat-jsvc, tomcat-javadoc, tomcat-webapps, tomcat-el-2.2-api, +4 more Red Hat Enterprise Linux 8 pki-servlet-engine, pki-servlet-4.0-api Red Hat Enterprise Linux 9 pki-servlet-engine, pki-servlet-4.0-api Red Hat Enterprise Linux 10 tomcat Red Hat Hardened Images hi/tomcat
    +3 more products
    Red Hat JBoss Web Server 5 jws5-tomcat, jws5-tomcat-lib, jws5-tomcat-jsvc, jws5-tomcat-javadoc, jws5-tomcat-selinux, jws5-tomcat-webapps, +7 more Red Hat JBoss Web Server 6 jws6-tomcat, jws6-tomcat-lib, jws6-tomcat-javadoc, jws6-tomcat-selinux, jws6-tomcat-webapps, jws6-tomcat-el-5.0-api, +4 more Red Hat JBoss Web Server 7 jws7-tomcat
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
20d ago

Exploit prediction

0.50% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
OSV 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Affected packages

ecosystem package affected fixed in
bitnami tomcat
>=9.0.118, <9.0.123
>=10.1.55, <10.1.61
>=11.0.22, <11.0.27
9.0.123
10.1.61
11.0.27

Affected products

  • Apache Software Foundation Apache Tomcat

Classification

Weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.