Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-10-20T13:46:50 tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE-488

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.

A flaw was found in Apache Tomcat. Incorrect object recycling and reuse during the HTTP/2 processing of asynchronous servlets can cause requests and responses to be mixed up between different users. A remote attacker could exploit this vulnerability to trigger unintended data cross-over, potentially leading to information disclosure.

A flaw was found in Apache Tomcat. When processing HTTP/2 requests using asynchronous servlets, improper object recycling and reuse can cause request and response data to be mixed up between concurrent client sessions. An unauthenticated remote attacker can exploit this condition by sending concurrent requests over HTTP/2, potentially receiving responses intended for other users and exposing sensitive application data processed within the Tomcat container context. Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling. Red Hat Hardened Images 2026-10-12T00:00:00Z RHSA-2026:81365 tomcat11-main-11.0.27-0.1.hum1 Red Hat Hardened Images 2026-10-20T00:00:00Z RHSA-2026:85926 tomcat10-main-10.1.61-0.1.hum1 Red Hat Enterprise Linux 10 Not affected tomcat Red Hat Enterprise Linux 10 Affected tomcat9 Red Hat Enterprise Linux 6 Not affected tomcat6 Red Hat Enterprise Linux 7 Not affected tomcat Red Hat Enterprise Linux 8 Not affected pki-deps:10.6/pki-servlet-engine Red Hat Enterprise Linux 8 Affected tomcat Red Hat Enterprise Linux 9 Not affected pki-servlet-engine Red Hat Enterprise Linux 9 Affected tomcat Red Hat Hardened Images Not affected hi/tomcat Red Hat JBoss Web Server 5 Not affected jws5-tomcat Red Hat JBoss Web Server 6 Not affected jws6-tomcat Red Hat JBoss Web Server 7 Not affected jws7-tomcat https://www.cve.org/CVERecord?id=CVE-2026-101356 https://nvd.nist.gov/vuln/detail/CVE-2026-101356 https://lists.apache.org/thread.html/d1xjt7bbjqw7y7n5mcb4fm815hpfgc27