Key points
- Apache Tomcat versions 11.0.22–26, 10.1.55–60, and 9.0.118–122 are affected.
- The issue involves incorrect object recycling during asynchronous servlet processing.
- The advisory does not state whether a patch or fix is available.
Apache Tomcat administrators must address a vulnerability in HTTP/2 asynchronous processing that allows user requests and responses to be mixed. The flaw affects specific ranges of versions 11, 10.1, and 9.0. Mark Thomas posted the advisory on October 20 with an important severity rating.
In plain English
When Apache Tomcat handles asynchronous tasks over HTTP/2, it sometimes reuses internal objects incorrectly. This recycling error causes the server to confuse data belonging to different users. One user might receive another user's response or have their request processed incorrectly. This breaks the isolation between separate client sessions.
The background
The advisory identifies the root cause as incorrect object recycling and re-use within the HTTP/2 processing logic. This vulnerability specifically targets asynchronous servlets. The issue was reported to the oss-security mailing list. It impacts a wide range of recent releases across three major version lines of the Apache Tomcat application server software.
What changes now
Teams using the affected versions must assume their HTTP/2 async endpoints are vulnerable. The advisory does not confirm if a fix is available. Operators cannot rely on an immediate software update to resolve the risk. They must evaluate their exposure to unauthenticated or multi-user HTTP/2 traffic. Monitoring for anomalous response patterns may help detect active exploitation or accidental data leakage between users.
Who needs to act first
Security teams should prioritize systems exposed to the public internet or handling sensitive multi-user data. Identify servers running the specific affected version ranges listed in the advisory. If possible, temporarily disable HTTP/2 support for asynchronous endpoints to reduce the attack surface. Test any configuration changes in a staging environment before applying them to production systems. Document the exposure risk for stakeholders while awaiting further information.
What to do and how to stay safe: Apache Tomcat
- Verify if your Tomcat instances fall within the affected version ranges for 11.0, 10.1, or 9.0.
- Review server configurations to see if HTTP/2 is enabled for asynchronous servlet processing.
- Monitor access logs for unusual patterns indicating request or response mix-ups between users.
- Prepare to apply a vendor update immediately once an official patch is released and tested.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Apache Tomcat versions are affected by CVE-2026-101356?
Versions 11.0.22 through 11.0.26, 10.1.55 through 10.1.60, and 9.0.118 through 9.0.122 are affected.
Is there a patch available for this vulnerability?
The source material does not state whether a patch or fix is available.
What is the severity of this issue?
The advisory rates the severity as important.
