Apache Tomcat allows handlers to reuse request and response objects improperly during HTTP/2 asynchronous servlet processing. When an error occurs, the server fails to recycle these objects correctly, resulting in a mix-up whereby a user's request or response data may be served to, or altered by, a different user. This flaw enables an attacker to read or modify another user's data, leading to confidentiality and integrity violations.

The flaw affects Apache Tomcat versions 9.0.118-9.0.122, 10.1.55-10.1.60 and 11.0.22-11.0.26 across all supported operating systems. Users running any of these releases should review their deployment to determine if HTTP/2 with async servlet processing is enabled.

The CVSS severity is 9.1, and the EPSS score is unavailable, but the vulnerability is listed as not part of the CISA KEV catalog. The flaw is exploitable remotely over HTTP/2 connections and requires only that an attacker can send a request that triggers an error during async servlet processing. Based on the description, it is inferred that an attacker could force the server to mix up request and response streams, potentially harvesting sensitive data or influencing application logic. The risk is moderate to high, given the ability to compromise user data, though it likely requires server accessibility and a suitable payload pattern.