CVE-2024-52317

🚨🚨CVE-2024-52317🚨🚨 CVE-2024-52317 - Apache Tomcat HTTP/2 Data Leakage Vulnerability Overview CVE-2024-52317 is a vulnerability affecting Apache Tomcat's HTTP/2 implementation. The issue arises due to improper recycling of HTTP/2 request and response resources, potentially leading to data leakage...

Belsen_Group-et-exploitation-de-la-CVE-2022-40684

BelsenGroup and exploitation of CVE-2022-40684 Context On January 29, 2025, a user of the cybercriminal forum BelsenGroup published a message claiming to hold 15,000 compromised Fortinet devices, with configuration files and VPN passwords. He now offers 1,000 exclusive targets for sale on the dar...

BIT-TOMCAT-2026-101356 Apache Tomcat: HTTP/2 request/response mix-up after error during async processing

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through...

CVE-2026-98804

A flaw was found in the Linux kernel's networking subsystem. When page pool statistics are enabled, a race condition in the bulk recycling mechanism can allow a memory pool to be freed before statistical updates finish processing. An attacker capable of triggering concurrent network buffer teardo...

CVE-2026-101356

A flaw was found in Apache Tomcat. Incorrect object recycling and reuse during the HTTP/2 processing of asynchronous servlets can cause requests and responses to be mixed up between different users. A remote attacker could exploit this vulnerability to trigger unintended data cross-over,...

Access Control Bypass

Overview org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser. Affected versions of this package are vulnerable to Access Control Bypass in the HTTP/2 asynchronous servlet processing. An attacker can cause requests and responses to be mixed up between users by exploiting incorre...

Access Control Bypass

Overview org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Access Control Bypass in the HTTP/2 asynchronous servlet processing. An attacker can cause requests and responses to be mixed up between users by exploiting...

CVE-2026-101356

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through...

UBUNTU-CVE-2026-101356

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through...

CVE-2026-101356 Apache Tomcat: HTTP/2 request/response mix-up after error during async processing

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through...

CVE-2026-101356

Apache Tomcat is vulnerable to an incorrect object recycling and re-use flaw affecting HTTP/2 processing of asynchronous servlets . This vulnerability can trigger a request and/or response mix-up between different users. The issue impacts versions 11.0.22 through 11.0.26 , 10.1.55 through 10.1.60...

CVE-2026-101356

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through...

CVE-2026-101356 Apache Tomcat: HTTP/2 request/response mix-up after error during async processing

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through...

tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing

A flaw was found in Apache Tomcat. Incorrect object recycling and reuse during the HTTP/2 processing of asynchronous servlets can cause requests and responses to be mixed up between different users. A remote attacker could exploit this vulnerability to trigger unintended data cross-over,...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: iouring/kbuf: check if target buffer list is still legacy on recycle There’s a gap between when the buffer was grabbed and when it potentially gets recycled; if the list is empty, someone could have upgraded it to a ring provided...

tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing

A flaw was found in Apache Tomcat. Incorrect object recycling and reuse during the HTTP/2 processing of asynchronous servlets can cause requests and responses to be mixed up between different users. A remote attacker could exploit this vulnerability to trigger unintended data cross-over,...

mssqlproxy

mssqlproxy mssqlproxy es un kit de herramientas diseñado para realizar movimiento lateral en entornos restringidos a través de un Microsoft SQL Server comprometido mediante reutilización de sockets. El cliente requiere impacket y privilegios sysadmin en el servidor SQL. Por favor, lea este artícu...

CVE-2026-98035

In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields when recycling rhtab elements rhtabmapupdateexisting and rhtabdeleteelem call bpfobjfreefields when replacing or deleting a value. These map operations can run from BPF programs in NMI context, where...

Incomplete Cleanup

Overview org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser. Affected versions of this package are vulnerable to Incomplete Cleanup via the StreamProcessor request-recycling path in the HTTP/2 connector. An attacker can cause one request from another user to fail by sending a...

Incomplete Cleanup

Overview org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Incomplete Cleanup via the StreamProcessor request-recycling path in the HTTP/2 connector. An attacker can cause one request from another user to fail by sending...