Apache Tomcat Fixes Critical CVE-2026-101356 HTTP/2 Data Leakage in 11.0.27, 10.1.61, 9.0.123
A critical vulnerability in Apache Tomcat allows data leakage between users via HTTP/2. Administrators must upgrade to specific patched versions immediately.
Key points
- CVE-2026-101356 is rated CVSS 9.1 Critical by NVD.
- The flaw causes request and response mix-ups in HTTP/2 async processing.
- Patches are available for Tomcat 11.0.27, 10.1.61, and 9.0.123.
Apache Software Foundation released patches on October 20 to address a critical vulnerability in Apache Tomcat that allows data leakage between users. The flaw, tracked as CVE-2026-101356, affects HTTP/2 processing of asynchronous servlets and has been assigned a CVSS score of 9.1 by the National Vulnerability Database.
At a glance
- CVE
- CVE-2026-101356
- Product
- Apache Tomcat
- CVSS
- 9.1 Critical
- Weakness
- —
- Exploited
- No known exploitation
The vulnerability stems from incorrect object recycling and re-use within the server’s HTTP/2 implementation. According to the advisory posted by Mark Thomas on the oss-security mailing list, this error can trigger a mix-up of requests and responses between different users. This issue affects multiple major branches of the web server software.
Context and Background
This release follows earlier security work by the Apache Tomcat team. As Threat Times reported on October 20, a previous critical flaw in Apache Tomcat versions through 11.0.26 allowed data leakage between requests via an AJP buffer under-read vulnerability. That issue required upgrades to version 11.0.27 to resolve.
The current CVE-2026-101356 is distinct from the AJP buffer issue but affects overlapping version ranges. The NVD record describes the weakness as an incorrect object recycling vulnerability. It specifically impacts how the server handles asynchronous servlets when using the HTTP/2 protocol.
Who Is Affected
Administrators running specific versions of Apache Tomcat are at risk. The vulnerability affects Apache Tomcat 11.0.22 through 11.0.26. It also impacts Apache Tomcat 10.1.55 through 10.1.60. Additionally, users of Apache Tomcat 9.0.118 through 9.0.122 are affected by this critical flaw.
The Apache Software Foundation has confirmed that these version ranges contain the defect. The oss-security advisory lists these exact version boundaries. Organizations must verify their current installation version against this list to determine exposure.
What should you do?
Users are recommended to upgrade to the patched versions immediately. The fix is available in Apache Tomcat 11.0.27. It is also available in Apache Tomcat 10.1.61. Furthermore, the patch is included in Apache Tomcat 9.0.123. These updates resolve the object recycling issue.
WHAT TO DO:
- Inventory all servers running Apache Tomcat to identify versions 11.0.22–11.0.26, 10.1.55–10.1.60, and 9.0.118–9.0.122.
- Schedule immediate upgrades to version 11.0.27, 10.1.61, or 9.0.123 depending on your supported branch.
- Monitor server logs for unusual HTTP/2 async processing errors or mixed response headers that may indicate exploitation.
- Review access controls for sensitive endpoints to limit potential damage if a mix-up occurs before patching.
What to do and how to stay safe: Apache Tomcat
- Vulnerability severity scores ignore your specific architecture and context.
- Exploitability depends on network exposure and user behavior, not just code flaws.
- Prioritization requires continuous asset inventory and threat intelligence alignment.
Risk-based vulnerability management focuses your limited resources on the flaws that actually threaten your business. Start by mapping your critical assets and checking for active exploits to prioritize your backlog.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-101356?
The National Vulnerability Database rates CVE-2026-101356 as 9.1, which is considered Critical.
Which Apache Tomcat versions are affected by this HTTP/2 flaw?
Affected versions are 11.0.22 through 11.0.26, 10.1.55 through 10.1.60, and 9.0.118 through 9.0.122.
Is there a patch available for this vulnerability?
Yes, users should upgrade to version 11.0.27, 10.1.61, or 9.0.123 to resolve the issue.
