Vulnpedia
← Search CVEs

CVE-2026-101356

CRITICAL 9.1

Published 2026-10-20 · Last modified 2026-10-20

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.

ELEVATED IMPACT

Severe if exploited (CVSS 9.1), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.5%chance of exploitation in 30 days · 42nd percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

9.1CVSS 3.1 · CRITICAL

  • ConfidentialityHigh
  • IntegrityNone
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Apache Software Foundation

Products Apache Tomcat

Weakness (CWE)

  • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References and research data (JSON)

Vendor product assessments

Showing 32 of 153 vendor product statements; 121 omitted. Read the full vendor advisory.

  • tomcat10-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling.
    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • tomcat10-admin-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling.
    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • tomcat10-docs-webapp-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling.
    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • tomcat10-jsp-3.1-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling.
    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • tomcat10-servlet-6.0-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling.
    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • tomcat10-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling.
    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • tomcat11-admin-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling.
    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • tomcat11-docs-webapp-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling.
    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • tomcat11-jsp-4.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling.
    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • tomcat11-servlet-6.1-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling.
    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • tomcat11-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling.
    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • tomcat9 as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat9

    • workaround: Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling.
    • none available: Affected
    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • tomcat9-el-3.0-api as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat9-el-3.0-api

    • workaround: Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling.
    • none available: Affected
    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • tomcat9-lib as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat9-lib

    • workaround: Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling.
    • none available: Affected
    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • tomcat9.src as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat9?arch=src

    • workaround: Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling.
    • none available: Affected
    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • tomcat-admin-webapps as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat-admin-webapps

    • workaround: Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling.
    • none available: Affected
    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • tomcat-jsp-2.3-api as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat-jsp-2.3-api

    • workaround: Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling.
    • none available: Affected
    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • tomcat-webapps as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat-webapps

    • workaround: Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling.
    • none available: Affected
    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • tomcat as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat

    • workaround: Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling.
    • none available: Affected
    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • tomcat-el-3.0-api as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat-el-3.0-api

    • workaround: Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling.
    • none available: Affected
    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • tomcat-lib as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat-lib

    • workaround: Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling.
    • none available: Affected
    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • tomcat.src as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat?arch=src

    • workaround: Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling.
    • none available: Affected
    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • tomcat as a component of Red Hat Enterprise Linux 10 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/tomcat

    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • tomcat-webapps as a component of Red Hat Enterprise Linux 10 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/tomcat-webapps

    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • tomcat6-jsp-2.1-api as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/tomcat6-jsp-2.1-api

    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • tomcat-admin-webapps as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/tomcat-admin-webapps

    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • tomcat-servlet-3.0-api as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/tomcat-servlet-3.0-api

    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • pki-servlet-engine as a component of Red Hat Enterprise Linux 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/pki-servlet-engine

    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • jws5-tomcat-java-jdk11 as a component of Red Hat JBoss Web Server 5 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/jws5-tomcat-java-jdk11

    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • jws5-tomcat-servlet-4.0-api as a component of Red Hat JBoss Web Server 5 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/jws5-tomcat-servlet-4.0-api

    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • jws6-tomcat-javadoc as a component of Red Hat JBoss Web Server 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/jws6-tomcat-javadoc

    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00
  • jws7-tomcat.src as a component of Red Hat JBoss Web Server 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/jws7-tomcat?arch=src

    Red Hat · CVE-2026-101356 · Updated 2026-10-21T19:42:59+00:00

All CVSS metrics

  • CRITICAL 9.1 v3.1 · ADP Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
  • CRITICAL 9.1 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS