Apache Tomcat HTTP/2 async servlet cross-user response mix-up via object recycling race

#!/usr/bin/env bash
# CVE-2026-101356 checker — Apache Tomcat HTTP/2 async object recycling race condition
# Exit codes: 0=PATCHED  1=VULNERABLE  2=UNKNOWN
set -euo pipefail

CATALINA_HOME="${1:-${CATALINA_HOME:-}}"

# Auto-detect if not provided
if [[ -z "$CATALINA_HOME" ]]; then
  for d in /opt/tomcat* /usr/share/tomcat* /usr/local/tomcat* /var/lib/tomcat*; do
    if [[ -f "$d/lib/catalina.jar" ]]; then
      CATALINA_HOME="$d"
      break
    fi
  done
fi

if [[ -z "$CATALINA_HOME" || ! -d "$CATALINA_HOME" ]]; then
  echo "UNKNOWN — Cannot locate Tomcat. Pass CATALINA_HOME as first argument."
  exit 2
fi

echo "[*] CATALINA_HOME: $CATALINA_HOME"

# --- Detect version ---
VERSION=""
if [[ -x "$CATALINA_HOME/bin/version.sh" ]]; then
  VERSION=$("$CATALINA_HOME/bin/version.sh" 2>/dev/null | grep -oP 'Server number:\s*\K[\d.]+' || true)
fi
if [[ -z "$VERSION" ]] && command -v unzip &>/dev/null; then
  VERSION=$(unzip -p "$CATALINA_HOME/lib/catalina.jar" \
    org/apache/catalina/util/ServerInfo.properties 2>/dev/null \
    | grep '^server.number=' | cut -d= -f2 | tr -d '[:space:]' || true)
fi
if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — Could not determine Tomcat version."
  exit 2
fi
echo "[*] Tomcat version: $VERSION"

# --- Parse version ---
IFS='.' read -r MAJ MIN PAT <<< "$VERSION"
MAJ=${MAJ:-0}; MIN=${MIN:-0}; PAT=${PAT:-0}

# --- Check affected ranges ---
IN_RANGE=0
if   [[ $MAJ -eq 11 && $MIN -eq 0 && $PAT -ge 22 && $PAT -le 26 ]]; then IN_RANGE=1
elif [[ $MAJ -eq 10 && $MIN -eq 1 && $PAT -ge 55 && $PAT -le 60 ]]; then IN_RANGE=1
elif [[ $MAJ -eq  9 && $MIN -eq 0 && $PAT -ge 118 && $PAT -le 122 ]]; then IN_RANGE=1
fi

if [[ $IN_RANGE -eq 0 ]]; then
  echo "PATCHED — Tomcat $VERSION is outside the affected range."
  exit 0
fi

# --- Check for HTTP/2 UpgradeProtocol ---
H2=0
CONF="$CATALINA_HOME/conf"
if grep -rql 'Http2Protocol' "$CONF/" 2>/dev/null; then
  H2=1
  echo "[!] HTTP/2 UpgradeProtocol FOUND in server.xml"
else
  echo "[*] HTTP/2 UpgradeProtocol not found in $CONF/"
fi

if [[ $H2 -eq 0 ]]; then
  echo "PATCHED (effective) — Version $VERSION is in the affected range but HTTP/2"
  echo "  is NOT enabled. Vulnerability requires HTTP/2. Upgrade still recommended."
  exit 0
fi

echo "=========================================="
echo "VULNERABLE — Tomcat $VERSION with HTTP/2 enabled."
echo "  Fix: upgrade to 11.0.27 / 10.1.61 / 9.0.123"
echo "  Workaround: remove Http2Protocol from server.xml"
echo "=========================================="
exit 1