{"schema":"vulnpedia.research/1","cve":"CVE-2026-101356","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://lists.apache.org/thread.html/d1xjt7bbjqw7y7n5mcb4fm815hpfgc27","tags":["vendor-advisory","vendor-reference"],"source":"mitre","sourceId":"apache","modified":"2026-10-20T13:46:50.842Z","origins":[{"source":"mitre","sourceId":"apache","modified":"2026-10-20T13:46:50.842Z","url":"https://lists.apache.org/thread.html/d1xjt7bbjqw7y7n5mcb4fm815hpfgc27"},{"source":"nvd","sourceId":"CVE-2026-101356","modified":"2026-10-20T19:35:38.940","url":"https://lists.apache.org/thread.html/d1xjt7bbjqw7y7n5mcb4fm815hpfgc27"},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://lists.apache.org/thread.html/d1xjt7bbjqw7y7n5mcb4fm815hpfgc27"}]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/27","tags":[],"source":"mitre","sourceId":"CVE","modified":"2026-10-20T18:09:51.253Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-10-20T18:09:51.253Z","url":"http://www.openwall.com/lists/oss-security/2026/10/20/27"},{"source":"nvd","sourceId":"CVE-2026-101356","modified":"2026-10-20T19:35:38.940","url":"http://www.openwall.com/lists/oss-security/2026/10/20/27"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101356","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-101356"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556186","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556186"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101356","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-101356"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101356","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101356"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:85926","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://access.redhat.com/errata/RHSA-2026:85926"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:81365","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://access.redhat.com/errata/RHSA-2026:81365"}]},{"source":"euvd","sourceId":"EUVD-2026-105011","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105011","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-105011","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105011"}]}],"packages":[],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"Red Hat Hardened Images:tomcat10-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms","product":"tomcat10-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling."}],"purl":"pkg:rpm/redhat/tomcat10@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat10-admin-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling."}],"purl":"pkg:rpm/redhat/tomcat10-admin-webapps@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat10-docs-webapp-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling."}],"purl":"pkg:rpm/redhat/tomcat10-docs-webapp@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat10-jsp-3.1-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling."}],"purl":"pkg:rpm/redhat/tomcat10-jsp-3.1-api@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat10-servlet-6.0-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling."}],"purl":"pkg:rpm/redhat/tomcat10-servlet-6.0-api@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"Red Hat Hardened Images:tomcat10-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat10-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling."}],"purl":"pkg:rpm/redhat/tomcat10-webapps@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"Red Hat Hardened Images:tomcat11-admin-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat11-admin-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling."}],"purl":"pkg:rpm/redhat/tomcat11-admin-webapps@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"Red Hat Hardened Images:tomcat11-docs-webapp-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat11-docs-webapp-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling."}],"purl":"pkg:rpm/redhat/tomcat11-docs-webapp@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"Red Hat Hardened Images:tomcat11-jsp-4.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat11-jsp-4.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling."}],"purl":"pkg:rpm/redhat/tomcat11-jsp-4.0-api@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"Red Hat Hardened Images:tomcat11-servlet-6.1-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat11-servlet-6.1-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling."}],"purl":"pkg:rpm/redhat/tomcat11-servlet-6.1-api@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"Red Hat Hardened Images:tomcat11-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat11-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling."}],"purl":"pkg:rpm/redhat/tomcat11-webapps@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"red_hat_enterprise_linux_10:tomcat9","product":"tomcat9 as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/tomcat9","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"red_hat_enterprise_linux_10:tomcat9-el-3.0-api","product":"tomcat9-el-3.0-api as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/tomcat9-el-3.0-api","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"red_hat_enterprise_linux_10:tomcat9-lib","product":"tomcat9-lib as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/tomcat9-lib","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"red_hat_enterprise_linux_10:tomcat9.src","product":"tomcat9.src as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/tomcat9?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"red_hat_enterprise_linux_8:tomcat-admin-webapps","product":"tomcat-admin-webapps as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/tomcat-admin-webapps","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"red_hat_enterprise_linux_8:tomcat-jsp-2.3-api","product":"tomcat-jsp-2.3-api as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/tomcat-jsp-2.3-api","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"red_hat_enterprise_linux_8:tomcat-webapps","product":"tomcat-webapps as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/tomcat-webapps","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"red_hat_enterprise_linux_9:tomcat","product":"tomcat as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/tomcat","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"red_hat_enterprise_linux_9:tomcat-el-3.0-api","product":"tomcat-el-3.0-api as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/tomcat-el-3.0-api","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"red_hat_enterprise_linux_9:tomcat-lib","product":"tomcat-lib as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/tomcat-lib","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"red_hat_enterprise_linux_9:tomcat.src","product":"tomcat.src as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/tomcat?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"red_hat_enterprise_linux_10:tomcat","product":"tomcat as a component of Red Hat Enterprise Linux 10","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/tomcat","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"red_hat_enterprise_linux_10:tomcat-webapps","product":"tomcat-webapps as a component of Red Hat Enterprise Linux 10","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/tomcat-webapps","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"red_hat_enterprise_linux_6:tomcat6-jsp-2.1-api","product":"tomcat6-jsp-2.1-api as a component of Red Hat Enterprise Linux 6","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/tomcat6-jsp-2.1-api","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"red_hat_enterprise_linux_7:tomcat-admin-webapps","product":"tomcat-admin-webapps as a component of Red Hat Enterprise Linux 7","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/tomcat-admin-webapps","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"red_hat_enterprise_linux_7:tomcat-servlet-3.0-api","product":"tomcat-servlet-3.0-api as a component of Red Hat Enterprise Linux 7","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/tomcat-servlet-3.0-api","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"red_hat_enterprise_linux_9:pki-servlet-engine","product":"pki-servlet-engine as a component of Red Hat Enterprise Linux 9","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/pki-servlet-engine","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"red_hat_jboss_web_server_5:jws5-tomcat-java-jdk11","product":"jws5-tomcat-java-jdk11 as a component of Red Hat JBoss Web Server 5","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/jws5-tomcat-java-jdk11","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"red_hat_jboss_web_server_5:jws5-tomcat-servlet-4.0-api","product":"jws5-tomcat-servlet-4.0-api as a component of Red Hat JBoss Web Server 5","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/jws5-tomcat-servlet-4.0-api","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"red_hat_jboss_web_server_6:jws6-tomcat-javadoc","product":"jws6-tomcat-javadoc as a component of Red Hat JBoss Web Server 6","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/jws6-tomcat-javadoc","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]},{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json","productId":"red_hat_jboss_web_server_7:jws7-tomcat.src","product":"jws7-tomcat.src as a component of Red Hat JBoss Web Server 7","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/jws7-tomcat?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-101356","modified":"2026-10-21T19:42:59+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101356.json"}]}],"vendorCoverage":{"total":153,"shown":32,"omitted":121,"source":"redhat"}}