Improper control of a resource through its lifetime in Apache Tomcat - CVE-2026-101356
Published: October 20, 2026
Vulnerability identifier: #VU156272
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-101356
CWE-ID: CWE-664
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause requests or responses to be mixed up between users, potentially disclosing information or causing requests to be processed in the wrong user context.
The vulnerability exists due to incorrect object recycling and reuse in Apache Tomcat HTTP/2 asynchronous servlet processing when handling errors during asynchronous processing. A remote attacker can trigger affected request processing to cause request or response data to be associated with another user.
Affected software
Apache Tomcat
How to mitigate CVE-2026-101356
Install security update from vendor's website.
Apache Tomcat - addressed in versions 9.0.123, 10.1.61, 11.0.27