CVE-2026-101356

Apache Tomcat: HTTP/2 request/response mix-up during asynchronous processing

Summary

Incorrect recycling of HTTP/2 asynchronous servlet objects can mix requests or responses between users, potentially exposing or altering another user’s data.

The issue affects Apache Tomcat 9.0.118 through 9.0.122 in the 9.0 branch and is fixed in Tomcat 9.0.123. The bundled version, 9.0.120, falls within this version range; exploitability depends on the conditions described below.

The Critical classification reflects the CISA assessment in the CVE record: 9.1 (CVSS 3.1). Apache rates this issue Important. The upstream severity is distinct from PageSeeder exposure.

For technical details, see the Apache Tomcat security advisory .

PageSeeder impact assessment

Assessment

PageSeeder is not affected by CVE-2026-101356 in its standard installer-generated and Docker configurations because Tomcat HTTP/2 is not enabled. Customised installations that enable HTTP/2 require a separate assessment.

Required conditions for exploitation: HTTP/2 processing of asynchronous servlets, with an error triggering incorrect request or response object reuse.

Relevant PageSeeder configuration: Windows and Linux installers generate HTTP/1.1 connectors without enabling HTTP/2; Docker also uses HTTP/1.1. No production startAsync() calls or async-supported declarations were found in PageSeeder source.

Evidence from source and configuration review:

• The supplied Docker connectors do not enable Tomcat HTTP/2.
• Repository searches found no production asynchronous servlet processing. Asynchronous WebSocket writes are separate from Servlet asynchronous request processing.
• Installer review confirms HTTP/1.1 connectors in windows/script/UpgradeFunctions.nsh (AddTomcatConnectors), linux/rpm/el7/includes/configure.sh and linux/rpm/el8/includes/bin/setup.sh (update_connector). No Http2Protocol or UpgradeProtocol is added.
• Linux EL8 and EL9 packages share the EL8 connector configuration through linux/build.gradle. Their supplied server.xml enables plaintext HTTP/1.1 on port 8282.

This assessment is limited to the repository revision and configuration reviewed on 11 November 2026. It does not independently verify the historical PageSeeder version range in the model advisory. Customised connectors, deployment descriptors, extensions and additional web applications may change exposure.

The PageSeeder installer source was also reviewed at commit a08323b (Windows, Linux EL7, EL8 and EL9). Installer review supports the standard configuration assessment; it does not establish the configuration of every deployed server. Linux RPM packaging marks server.xml CONFIG | NOREPLACE, so existing administrator changes can survive upgrades.

Recommended action

Administrators of customised installations should check both Tomcat HTTP/2 and asynchronous servlet use, including additional web applications. If both are enabled, upgrade Tomcat to 9.0.123 or later. Disabling Tomcat HTTP/2 removes this prerequisite.

For installations matching the reviewed unaffected configuration, no CVE-specific emergency change is required. Confirm the installed configuration before relying on this conclusion. Use a supported PageSeeder distribution containing an updated Tomcat where available; this advisory does not announce a PageSeeder release date or confirm that such a distribution has shipped.

Dependency maintenance recommendation: update the bundled Tomcat to 9.0.123 or a later supported release, which also incorporates fixes for the other Critical CVEs covered in this advisory set.

References

• CVE-2026-101356 record and CISA severity assessment 
• Apache Tomcat security advisory 
• Apache Tomcat 9 security advisories 
• Apache Tomcat 9 changelog