critical · CVSS v3 9.1

CVE-2026-101356

Apache Tomcat's HTTP/2 processing incorrectly recycles objects, causing request/response mix-up between users. This flaw can lead to data le

Overview

Apache Tomcat's HTTP/2 processing incorrectly recycles objects, causing request/response mix-up between users. This flaw can lead to data leakage or session confusion. It affects Tomcat 9, 10, and 11 versions up to specified releases.

Description

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.

Impact

Confidentiality: user data may be exposed to other users. Integrity: request/response mix-up can corrupt application state. Availability: potential denial of service if exploited. Defenders: application owners and system administrators.

Remediation

Upgrade Tomcat to 9.0.123, 10.1.61, or 11.0.27. If upgrade is not possible, disable HTTP/2 or configure the server to reject HTTP/2 connections. Verify the patch by checking the Tomcat version string.

Risk context

Critical severity with CVSS 9.1 indicates a high risk to affected deployments. Immediate patching is recommended to mitigate potential data exposure or service disruption.

Affected products

  • Apache Tomcat 9
  • Apache Tomcat 10
  • Apache Tomcat 11

Scores

Severity
critical
CVSS v2
7.5
CVSS v3
9.1
CVSS v4
—
EPSS
—

Apache Tomcat HTTP/2 Object Reuse Data Leakage Critical Upgrade Defender

← All CVEs

Related CVEs

critical

CVE-2026-113390

A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/option causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

View analysis

critical

CVE-2026-43844

A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.

View analysis

critical

CVE-2026-43845

A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.

View analysis

critical

CVE-2026-43847

A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled.

View analysis