Apache Tomcat HTTP/2 async error can mix up requests
What's new
First merged summary.
Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI
Apache rates CVE-2026-101356 important; listed Tomcat ranges are affected and no fix is in the notice.
Mark Thomas reported CVE-2026-101356 in Apache Tomcat. Incorrect object recycling during HTTP/2 processing of asynchronous servlets can mix up requests or responses between users. Apache rates the issue important. Affected ranges are 11.0.22 through 11.0.26, 10.1.55 through 10.1.60, and 9.0.118 through 9.0.122. The posted notice is cut off before any fix or exploitation status.
Key facts
- CVE-2026-101356 is an HTTP/2 request or response mix-up.
- Apache rates the severity important.
- Tomcat 11.0.22 through 11.0.26 is affected.
- Tomcat 10.1.55 through 10.1.60 is affected.
- Tomcat 9.0.118 through 9.0.122 is affected.
- The visible notice includes no fixed version.
Timeline
dated events in the reporting · oldest first- Oct 20, 2026Mark Thomas reports CVE-2026-101356 to oss-security. · oss-security
What each outlet adds
beyond the shared facts- oss-securityNames three affected Tomcat ranges and important severity.
- Vendors
- Apache
- Products
- Apache TomcatTomcat
Coverage
oldest first · one row per article · UTC- · 10d ago
oss-securityFirst report
Tomcat HTTP/2 async flaw can mix users' requests (CVE-2026-101356)
Apache rates the issue important; the excerpt lists three affected version ranges and no fix.
- · 10d ago
Apache Tomcat AJP under-read can mix responses (CVE-2026-103119)
Tomcat 11.0.0-M25 through 11.0.26 can send part of one response body to the next request on the same connection.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-101356+1 related CVE | HTTP/2 request/response mix-up in Apache Tomcat async servlets | 9.1 | — |