Recommended action window: Monitor and triage in normal cycle
NVD description
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Tomcat details: • CVE-2026-101296: JNDIRealm with a non-GSSAPI SASL mechanism logs users in without checking the password. • CVE-2026-101356/103119: HTTP/2 async & AJP responses can reach the wrong user, leaking data. Vendor rating: Important. Upgrade beyond 11.0.26 / 10.1.60 / 9.0.122. https://lists.apache.org/thread/bl52b9go9ckoov8x4v3dt6rkm573cygd
Tomcat details: • CVE-2026-101296: JNDIRealm with a non-GSSAPI SASL mechanism logs users in without checking the password. • CVE-2026-101356/103119: HTTP/2 async & AJP responses can reach the wrong user, leaking data. Vendor rating: Important. Upgrade beyond 11.0.26 / 10.1.60 / 9.0.122. https://lists.apache.org/thread/bl52b9go9ckoov8x4v3dt6rkm573cygd