CVE-2026-101356
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of…
- Risk score
- 68/100
- CVSS
- 9.1 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 20 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Apache Tomcat has a vulnerability in HTTP/2 processing of asynchronous servlets, which can cause a request and/or response mix-up between users. An attacker could exploit this to gain high-level access.
- Affected
- {'products': ['Apache Tomcat'], 'packages': [], 'versions': ['11.0.22 through 11.0.26', '10.1.55 through 10.1.60', '9.0.118 through 9.0.122']}
- Fix
- Upgrade to version 11.0.27, 10.1.61 or 9.0.123
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.1 critical
- Remotely exploitable without logging in
References
Original description
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.
Last activity 20 Oct 2026. Patch Forecast updates every hour.