Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-101356: Apache Tomcat on Debian could mishandle data objects
CVE-2026-101356 · published 3 days ago
Summary
Certain versions of Apache Tomcat packaged for Debian (Tomcat 6, 9, 10, and 11) can incorrectly recycle internal objects, which may let an attacker cause errors or see information they shouldn’t. This could affect the stability of the web applications you run on those servers. Apply the latest security updates from Debian or the Apache Tomcat project as soon as they are available.
What to do
- Update debian tomcat9 to version 9.0.70-2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | apache software foundation | apache tomcat | <= 11.0.26 |
| Debian:13 | debian | tomcat11 | All versions |
| Debian:12 | debian | tomcat10 | All versions |
| Debian:12 | debian | tomcat9 |
< 9.0.70-2 Fix: upgrade to 9.0.70-2
|
| Ubuntu:Pro:14.04:LTS | canonical | tomcat6 | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | tomcat7 | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | tomcat8 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | tomcat9 | All versions |
| Ubuntu:24.04:LTS | canonical | tomcat10 | All versions |
| Ubuntu:26.10 | canonical | tomcat11 | All versions |
Original advisory text
DEBIAN-CVE-2026-101356
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.
References
- https://lists.apache.org/thread.html/d1xjt7bbjqw7y7n5mcb4fm815hpfgc27
- http://www.openwall.com/lists/oss-security/2026/10/20/27
- https://security-tracker.debian.org/tracker/CVE-2026-101356 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-101356 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-101356 Third Party Advisory
- https://github.com/apache/tomcat/commit/1dc6aa151b3b99b32ac9ae7c60e41c326063321b Third Party Advisory
- https://github.com/apache/tomcat/commit/6c7da60893bd186d6cb2df7330299d7e70e68279 Third Party Advisory
- https://github.com/apache/tomcat/commit/4b1eb9a1664b10471f5740279d9f2e2259c5d108 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
9.1
Critical
Type
CWE-362Race Condition
Timeline
Published20 Oct 2026
Updated23 Oct 2026
First seen20 Oct 2026
Sources
CVE-2026-101356 · NVD
CVE-2026-101356 · MITRE
DEBIAN-CVE-2026-101356 · OSV
UBUNTU-CVE-2026-101356 · OSV
Track software like this
Free during beta