CVE-2026-101356 Security Details

CVE ID

CVE-2026-101356

CWE

CWE-362

CVE Description

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.

Published

Oct 21, 2026

CVSS Score & Severity

9.3Critical

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS Score

0.518%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/apache/coyote/http2/Stream.recycle()V

JVM

Affected Ecosystems

affected

Source

National Vulnerability Database

References

Apache · AnnouncementPROJECT

GitHub · Advisory · GHSA-w9r8-5j45-v8mgTHIRD_PARTY