⚠️ PATCH NOW
Apache Tomcat fixed two flaws (CVSS 9.1): under load, one user's request or response can land in another's session. No attacker needed.
Affects Tomcat 9.0, 10.1 and 11.0.
Fix: update to 9.0.123 / 10.1.61 / 11.0.27.
https://suriq.io/blog/apache-tomcat-cve-2026-101356-data-mix-up
SuriqApache Tomcat CVE-2026-101356: Data Mix-Up Flaws, PatchApache Tomcat fixed two CVSS 9.1 flaws (CVE-2026-101356, CVE-2026-103119) that can send one user's request or response to another. Affected versions and what to do.