{"id":"CVE-2026-101356","published":"2026-10-20T14:16:55.767","lastModified":"2026-10-20T19:35:38.940","description":"Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122.\n\n\n\nUsers are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","cwes":["CWE-362"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread.html/d1xjt7bbjqw7y7n5mcb4fm815hpfgc27","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/27","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Incorrect object recycling in Apache Tomcat's HTTP/2 async servlet processing can cause request and response data to leak between users, compromising confidentiality and availability.","exploitability":"Remote exploitation requires no authentication or user interaction and exploits the race condition during asynchronous servlet handling; success depends on precise timing and concurrent requests.","blast_radius":"An attacker could read other users' responses or trigger service disruption by corrupting request/response streams, affecting all HTTP/2 async servlet users on the server.","remediation":"Upgrade to Apache Tomcat 11.0.27, 10.1.61, or 9.0.123 immediately.","detection":"Look for unexpected cross-session response content in access logs (e.g., User A receiving User B's data), anomalous HTTP/2 stream multiplexing errors, or repeated 4xx/5xx responses during high-concurrency async servlet activity.","tags":["http2","async-servlet","session-mixup","cwe-362","tomcat"],"model":"garnet-coder","analyzedAt":"2026-10-25T08:49:48.202Z"}}