External risk intelligence

Apache Tomcat HTTP/2 Request Response Mix-up Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-101356

Apache Tomcat is a widely deployed web server and servlet container designed to handle HTTP/2 traffic directly. As a core infrastructure component for hosting web applications and public-facing APIs, it is typically deployed at the network edge to process external requests, making this service public-facing by design in common deployments.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Apache Tomcat's handling of HTTP/2 traffic could potentially lead to a mix-up of user requests and responses. This technology is fundamental to many web applications and APIs, and its exposure could have broad implications for how services interact. The main concern is confirming the relevance and exposure of this technology within our environment.

Tomcat might mix up user requests.
Impacts widely used web server technology.
Confirm if Tomcat is in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted HTTP/2 requests to a vulnerable Apache Tomcat server. This could lead to a mix-up where a user receives a response intended for another user.

Network access required.
Triggered by HTTP/2 request processing.
Risk of user data mix-up.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability in Apache Tomcat could affect HTTP/2 processing, potentially leading to request and response mix-ups between users. This means sensitive information exchanged during these interactions might be exposed or mishandled.

User requests and responses could be mixed.
Network requests can be intercepted.
Sensitive data may be exposed.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Apache Tomcat's HTTP/2 processing could lead to request and response mix-ups between users. Technical leaders, security teams, and system owners should initiate an inventory of all Tomcat instances, prioritizing those exposed externally and serving critical business functions. Identifying the accountable application or infrastructure owner for each instance is the crucial first step before planning targeted remediation.

Infrastructure or application teams own remediation.
Verify external reachability and business criticality.
Plan coordinated updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache Tomcat?

Apache Tomcat is an open-source web server and servlet container. It provides the environment where Java-based web applications and APIs run. It is a fundamental piece of infrastructure that processes web traffic—including modern HTTP/2 connections—allowing users to interact with applications hosted on servers.

What does CVE-2026-101356 mean?

This CVE describes a weakness classified as CWE-362, or a race condition. In Apache Tomcat, the issue stems from incorrect object recycling when handling HTTP/2 asynchronous servlets. Essentially, the software may fail to properly clear or isolate data, causing it to confuse one user's request or response with another's.

How is this HTTP/2 vulnerability triggered?

The issue is triggered when the server processes specific HTTP/2 requests using asynchronous servlets. It is not triggered by standard, non-asynchronous HTTP/1.1 traffic. The flaw relies on the timing of request handling, where the improper re-use of internal objects leads to data being mistakenly routed to the wrong user session.

Is my instance affected by this vulnerability?

Halo Surface Signal notes that because Apache Tomcat is often deployed as a core infrastructure component at the network edge to handle HTTP/2 traffic directly, it is frequently public-facing. If your Tomcat instance is exposed to the internet and configured to use HTTP/2, it is a higher priority for review.

How do I respond to this Apache Tomcat advisory?

Start by auditing your environment to identify all running Tomcat instances and verify their version numbers. If you are using affected versions in the 11.0.x, 10.1.x, or 9.0.x series, plan to update to the patched versions—11.0.27, 10.1.61, or 9.0.123, respectively—during your next scheduled maintenance window.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.