IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
9.1Kritisch

CVE-2026-101356Apache Tomcat: HTTP/2 request/response mix-up after error during async processing

Apache Software Foundation Apache Tomcat Veröffentlicht: (vor 25 Tagen)

Beschreibung

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.

Schwachstellentyp (CWE): CWE-362

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
Apache Software Foundation Apache Tomcat 11.0.22 – ≤ 11.0.26, 10.1.55 – ≤ 10.1.60, 9.0.118 – ≤ 9.0.122

Referenzen und Patches

Neue CVEs im selben Produkt — Apache Tomcat

9.1Kritisch
CVE-2026-103119

Apache Tomcat: AJP response mix-up

Apache Software Foundation Apache Tomcat

Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second requ…

7.5Hoch
CVE-2026-93446

Apache Tomcat: Possible TLS 1.3 connection failures

Apache Software Foundation Apache Tomcat

Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122. Users are recommended…

7.5Hoch
CVE-2026-88041

Apache Tomcat: HTTP/2 trailer header cross-contamination

Apache Software Foundation Apache Tomcat

Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.26, from 10.1.27 through 10.1.60, from 9.0.92 through…