CVE-2026-101356

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through...

CVE-2026-101356 Apache Tomcat: HTTP/2 request/response mix-up after error during async processing

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through...

EUVD-2026-105011

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through...

CVE-2026-101356 Apache Tomcat: HTTP/2 request/response mix-up after error during async processing

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through...

CVE-2026-101356

Apache Tomcat is vulnerable to an incorrect object recycling and re-use flaw affecting HTTP/2 processing of asynchronous servlets . This vulnerability can trigger a request and/or response mix-up between different users. The issue impacts versions 11.0.22 through 11.0.26 , 10.1.55 through 10.1.60...

Apache Tomcat 9.0.118 < 9.0.123 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 9.0.123. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat9.0.123security-9 advisory. - A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was...

Apache Tomcat 10.1.55 < 10.1.61 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 10.1.61. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat10.1.61security-10 advisory. - A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was...

PT-2026-118374

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through...

CVE-2026-86350

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-86350 CVE-2026-86350 Apache Tomcat 9.0.121 - Apache Software Foundation I am @abraxasnull. Loopback lab. The client is CVE-2026-86350-Abraxas-Labs.py. HTTP/2 header mix-up. A regression in the CVE-2026-41293...

Fixed in Apache Tomcat 11.0.27

Important: AJP response mix-up CVE-2026-103119 A buffer under-read meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly...

MGASA-2026-0479 Updated tomcat package fixes security vulnerabilities

OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. CVE-2026-73581 Cross-context authentication mix-up with Jakarta Authentication configured. CVE-2026-75973 Bypass of security constraints for WebSocket endpoints. CVE-2026-76183 Transfer-Encoding honored for...

AZL-106248 CVE-2026-98327 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: reset the CSA state when leaving ifmsh-csa is allocated in ieee80211meshcsabeacon and only freed in ieee80211meshfinishcsa, i.e. when the channel switch completes. Leaving the mesh while a switch is still...

BIT-TOMCAT-2026-86350 Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up

Inconsistent interpretation of HTTP/2 requests 'HTTP Request/Response smuggling' vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from...

Exploit for CVE-2026-86350

abraxaslabs.tech · github.com/abraxas ·&...

SUSE CVE-2026-86350

Inconsistent interpretation of HTTP/2 requests 'HTTP Request/Response smuggling' vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from...

Linux Distros Unpatched Vulnerability : CVE-2026-86350

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inconsistent interpretation of HTTP/2 requests 'HTTP Request/Response smuggling' vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293...

DEBIAN-CVE-2026-86350

Inconsistent interpretation of HTTP/2 requests 'HTTP Request/Response smuggling' vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from...

CVE-2026-86350

Inconsistent interpretation of HTTP/2 requests 'HTTP Request/Response smuggling' vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from...

CVE-2026-86350

Inconsistent interpretation of HTTP/2 requests 'HTTP Request/Response smuggling' vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from...

UBUNTU-CVE-2026-86350

Inconsistent interpretation of HTTP/2 requests 'HTTP Request/Response smuggling' vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from...