Apache Tomcat CVE-2026-101356

Exploitation requires the server to be processing HTTP/2 connections AND to be using asynchronous servlets - both must be in use on the same deployment for the object-recycling race to be reachable. Deployments serving only HTTP/1.1, or that do not use async servlet processing, are not affected. The flaw is unauthenticated and network-reachable (PR:N, AV:N), but as a race condition it depends on concurrent in-flight requests and timing, so impact is probabilistic rather than deterministic and is most dangerous on multi-tenant or high-concurrency servers where distinct users' requests overlap. Affected version windows are narrow and specific: 11.0.22-11.0.26, 10.1.55-10.1.60, and 9.0.118-9.0.122; versions outside these ranges are not in scope.

This is a genuine high-priority issue for internet-facing Tomcat deployments, though several risk signals are missing and should temper urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/A:H, score 9.1) indicates a remote, unauthenticated, network-reachable flaw, which is severe. However, the root cause is a race condition (CWE-362) in HTTP/2 object recycling, and race conditions realistically require concurrent traffic and timing alignment that the vendor's AC:L rating arguably understates - a more honest attack complexity is High, which lowers practical exploitability. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and no public exploit code was identified at time of analysis, so there is no public exploit identified at time of analysis. The impact profile is also notable: this is tagged as Information Disclosure and the CVSS shows C:H (one user receiving another user's data) with A:H but I:N, meaning the vendor treats cross-user response leakage and request failures as the primary harm rather than data tampering. Net: prioritize patching on multi-tenant or shared Tomcat instances with HTTP/2 and async servlets, but the absence of KEV/POC/EPSS signals means this is a patch-promptly rather than drop-everything emergency.

An attacker (or even an unlucky legitimate user) sends concurrent HTTP/2 requests to a Tomcat server running asynchronous servlets, and the race in object recycling causes one user's request or response to be crossed with another's - leaking session data, authenticated content, or PII between unrelated users. Because exploitation depends on timing and concurrent load rather than a deterministic payload, a remote attacker would flood the server with parallel HTTP/2 streams to increase the probability of a mix-up. No public exploit code was identified at time of analysis, and the condition can also occur accidentally under normal high-concurrency traffic.