CVE-2026-101356

A flaw was found in Apache Tomcat. Incorrect object recycling and reuse during the HTTP/2 processing of asynchronous servlets can cause requests and responses to be mixed up between different users. A remote attacker could exploit this vulnerability to trigger unintended data cross-over, potentially leading to information disclosure.

A flaw was found in Apache Tomcat. When processing HTTP/2 requests using asynchronous servlets, improper object recycling and reuse can cause request and response data to be mixed up between concurrent client sessions. An unauthenticated remote attacker can exploit this condition by sending concurrent requests over HTTP/2, potentially receiving responses intended for other users and exposing sensitive application data processed within the Tomcat container context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling.