CVE-2026-101356

Summary

Incorrect object recycling in Apache Tomcat's HTTP/2 async servlet processing can cause request and response data to leak between users, compromising confidentiality and availability.

Exploitability

Remote exploitation requires no authentication or user interaction and exploits the race condition during asynchronous servlet handling; success depends on precise timing and concurrent requests.

Blast radius

An attacker could read other users' responses or trigger service disruption by corrupting request/response streams, affecting all HTTP/2 async servlet users on the server.

Detection

Look for unexpected cross-session response content in access logs (e.g., User A receiving User B's data), anomalous HTTP/2 stream multiplexing errors, or repeated 4xx/5xx responses during high-concurrency async servlet activity.

Prioritized remediation

Upgrade to Apache Tomcat 11.0.27, 10.1.61, or 9.0.123 immediately.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.