Apache Tomcat Critical HTTP/2 Async Recycling Bug Leaks User Data; Patch Now
A critical bug in Apache Tomcat allows HTTP/2 asynchronous requests to mix, potentially leaking data between users until patches are applied.
Key points
- CVE-2026-101356 carries a CVSS score of 9.1, rated critical by the National Vulnerability Database.
- The flaw involves incorrect object recycling during HTTP/2 processing of asynchronous servlets.
- Vendors have released patches for versions 11.0.27, 10.1.61, and 9.0.123 to resolve the issue.
Attackers exploiting this vulnerability can cause request and response data to mix between different users. This occurs when Apache Tomcat processes HTTP/2 asynchronous servlets incorrectly. The National Vulnerability Database rates CVE-2026-101356 as critical with a CVSS score of 9.1. The flaw allows an attacker to potentially access sensitive information belonging to other users on the same server instance.
How it unfolded
- The issue stems from incorrect object recycling and re-use in Apache Tomcat's HTTP/2 processing engine.
- This behavior triggers a mix-up of requests and/or responses between users during asynchronous servlet operations.
- Mark Thomas posted the advisory on October 20, detailing the severity and affected version ranges.
Who is affected
Apache Tomcat versions 11.0.22 through 11.0.26 are vulnerable to this request mixing flaw. Organizations running Apache Tomcat 10.1.55 through 10.1.60 face the same risk of data leakage. Additionally, users of Apache Tomcat 9.0.118 through 9.0.122 are exposed to this critical vulnerability. The Apache Software Foundation confirmed these ranges in the official advisory.
The fix
Users are recommended to upgrade to version 11.0.27 to address this issue. Apache Tomcat 10.1.61 also contains the necessary fix for this vulnerability. Administrators running the 9.0 branch should update to version 9.0.123. These updates correct the object recycling logic that caused the HTTP/2 request mix-up.
What made it possible
Teams usually encounter this class of flaw when connection state is not properly isolated. The weakness depends on the server reusing internal objects for new requests without clearing previous data. This serves the initial access or data theft stage of an intrusion. Check whether your infrastructure relies on asynchronous processing. Ensure that session boundaries are strictly enforced. Monitor logs for unexpected request routing. Verify that object pools are cleared before reuse.
What to do and how to stay safe: Apache Tomcat
- Verify your current Apache Tomcat version against the affected ranges listed in the advisory.
- Plan an immediate upgrade to the patched versions 11.0.27, 10.1.61, or 9.0.123.
- Monitor server logs for unusual HTTP/2 request patterns or response anomalies.
- Restrict HTTP/2 access if upgrading is not immediately possible to reduce exposure.
Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-101356?
The National Vulnerability Database rates the vulnerability as critical with a CVSS score of 9.1.
Which Apache Tomcat versions are affected?
Versions 11.0.22-26, 10.1.55-60, and 9.0.118-122 are affected by this flaw.
Is there a fix available?
Yes, upgrades to versions 11.0.27, 10.1.61, and 9.0.123 fix the issue.
