CVE-2026-101356

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread.html/d1xjt7bbjqw7y7n5mcb4fm815hpfgc27
http://www.openwall.com/lists/oss-security/2026/10/20/27

Configurations

No configuration.

History

20 Oct 2026, 19:17

Type	Values Removed	Values Added
References		() http://www.openwall.com/lists/oss-security/2026/10/20/27 -
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.1
CWE		CWE-362

20 Oct 2026, 14:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-20 14:16

Updated : 2026-10-20 19:35

NVD link : CVE-2026-101356

Mitre link : CVE-2026-101356

CVE.ORG link : CVE-2026-101356

JSON object : View

Products Affected

No product.

CWE

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

{"id": "CVE-2026-101356", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-101356", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-20T18:17:35.437643Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Tomcat", "versions": [{"status": "affected", "version": "11.0.22", "versionType": "semver", "lessThanOrEqual": "11.0.26"}, {"status": "affected", "version": "10.1.55", "versionType": "semver", "lessThanOrEqual": "10.1.60"}, {"status": "affected", "version": "9.0.118", "versionType": "semver", "lessThanOrEqual": "9.0.122"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-20T14:16:55.767", "references": [{"url": "https://lists.apache.org/thread.html/d1xjt7bbjqw7y7n5mcb4fm815hpfgc27", "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/10/20/27", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122.\n\n\n\nUsers are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue."}], "lastModified": "2026-10-20T19:35:38.940", "sourceIdentifier": "security@apache.org"}