PULSE
ES
FEED
ransomaurora reclama a Duarte Nursery, Inc. · US · Agriculture and Food Productionransomn0n reclama a 51Ridge (Newark NJ hosting/IT) · US · Technologyransombooba project reclama a Research Foundation of The City University of New York · US · Educationransombooba project reclama a Chicago Vein Institute · US · Healthcareransombooba project reclama a Pearland Pediatrics · US · Healthcareransombooba project reclama a City of Mt. Angel, Oregon · US · Government & Defenseransombooba project reclama a City Hall - Everett, MA · US · Government & Defenseransommimori reclama a OpenText · CA · Technologyransommimori reclama a Aveva · GB · Manufacturingransombooba project reclama a COASTAL CAROLINA NEUROPSYCHIATRIC CENTER, PA · US · Healthcareransomn0n reclama a Company #98 · ET · Not Foundransomn0n reclama a Company #97 · TN · Not Foundransomn0n reclama a Company #96 · TT · Not Foundransomn0n reclama a Company #95 · CH · Not Foundransomaurora reclama a Duarte Nursery, Inc. · US · Agriculture and Food Productionransomn0n reclama a 51Ridge (Newark NJ hosting/IT) · US · Technologyransombooba project reclama a Research Foundation of The City University of New York · US · Educationransombooba project reclama a Chicago Vein Institute · US · Healthcareransombooba project reclama a Pearland Pediatrics · US · Healthcareransombooba project reclama a City of Mt. Angel, Oregon · US · Government & Defenseransombooba project reclama a City Hall - Everett, MA · US · Government & Defenseransommimori reclama a OpenText · CA · Technologyransommimori reclama a Aveva · GB · Manufacturingransombooba project reclama a COASTAL CAROLINA NEUROPSYCHIATRIC CENTER, PA · US · Healthcareransomn0n reclama a Company #98 · ET · Not Foundransomn0n reclama a Company #97 · TN · Not Foundransomn0n reclama a Company #96 · TT · Not Foundransomn0n reclama a Company #95 · CH · Not Found
← All CVEs
CVE WatchOct 20, 2026

CVE-2026-101356

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger reques

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Oct 20, 2026 · Last modified: Oct 20, 2026

EPSS · 30d

Not enough EPSS history yet.

Technical description

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.

Official references
Related CVEs

No related CVEs by CWE or product.