Loading vulnerability…
Cross-user HTTP/2 request and response mix-up in Apache Tomcat
CVE-2026-101356 is an incorrect object recycling and reuse vulnerability in Apache Tomcat's HTTP/2 processing of asynchronous servlets. Following an asynchronous processing error, internal objects can be incorrectly recycled and reused, causing requests and/or responses to become mixed between users. This can expose information across user boundaries or associate requests with the wrong user context. Affected versions are 11.0.22–11.0.26, 10.1.55–10.1.60, and 9.0.118–9.0.122. Apache rates the vulnerability Important.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Cross-user request and response mix-ups can disclose sensitive response data to unintended recipients and cause requests to be processed in the wrong user context, compromising isolation between users. The precise extent of exposure depends on the affected application's processing and data.
If you can’t patch tonight, do this now.
No vendor-specified interim workaround is documented. Disabling HTTP/2 on affected Tomcat deployments would remove the identified vulnerable processing path, but is a configuration-based precaution rather than a documented vendor workaround.
Patch, then assume compromise.
Upgrade Apache Tomcat to 11.0.27 or later in the 11.0 branch, 10.1.61 or later in the 10.1 branch, or 9.0.123 or later in the 9.0 branch. For distribution-managed installations, obtain a package incorporating the corresponding upstream fix or migrate to a fixed supported release if the distribution does not provide a patch.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.