CVE-2026-80353
UnknownSummary
A TOCTOU race condition in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorized local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. The issue affects versions 9.0.47 through 9.0.122.
Risk Assessment
A local unauthorized user may gain access to the unix domain socket, potentially leading to unauthorized service access.
Recommendation
Upgrade Apache Tomcat to version 9.0.123.
Other vulnerabilities in Apache Tomcat
See all- CVE-2026-93446Unknown
Incomplete cleanup in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. The issue affects versions 11.0.0-M21 through 11.0.26, 10.1.25 through 10.1.60, and 9.0.90 through 9.0.122.
- CVE-2026-88041Unknown
Incomplete cleanup in Apache Tomcat allowed trailer information from a previous request to leak into a subsequent request. The issue affects versions 11.0.0-M23 through 11.0.26, 10.1.27 through 10.1.60, and 9.0.92 through 9.0.122.
- CVE-2026-74049Unknown
Execution After Redirect (EAR) vulnerability in Apache Tomcat. Affects versions 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, and 9.0.0.M1 through 9.0.122; EOL versions 8.5.0-8.5.100 and 7.0.0-7.0.109 are also known to be affected.
- CVE-2026-74048Unknown
Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat: if OpenSSLLifecycleListener is configured for FIPS mode but FIPS activation fails, Tomcat logs an error but continues using JSSE in non-FIPS mode with the provided configuration. Affects versions 11.0.0-M14 through 11.0.26, 10.1.22 through 10.1.60, and 9.0.92 through 9.0.122.
- CVE-2026-101356Unknown
Incorrect object recycling and reuse in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. Affects versions 11.0.22 through 11.0.26, 10.1.55 through 10.1.60, and 9.0.118 through 9.0.122.
- CVE-2026-101296Unknown
A missing critical authentication step in Apache Tomcat when the JNDI realm was configured with a non-GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. Affects versions 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, and 9.0.0.M1 through 9.0.122; EOL versions 8.5.0-8.5.100 and 7.0.0-7.0.109 are also known to be affected.
- CVE-2026-43513High
The vulnerability related to improper handling of case sensitivity in LockOutRealm in Apache Tomcat may lead to unauthorized access. It affects versions from 11.0.0-M1 to 11.0.21, from 10.1.0-M1 to 10.1.54, from 9.0.0.M1 to 9.0.117, from 8.5.0 to 8.5.100, and from 7.0.0 to 7.0.109.
- CVE-2026-42498High
A vulnerability in Apache Tomcat related to the exposure of the HTTP Authentication Header to unexpected hosts during WebSocket authentication. It affects versions from 11.0.0-M1 to 11.0.21, 10.1.0-M1 to 10.1.54, 9.0.2 to 9.0.117, 8.5.24 to 8.5.100, and 7.0.83 to 7.0.109.
- CVE-2026-41284High
There is a vulnerability in Apache Tomcat related to resource allocation without limits or throttling. This affects versions from 11.0.0-M1 to 11.0.21, from 10.1.0-M1 to 10.1.54, and from 9.0.0.M1 to 9.0.117.
- CVE-2025-48989High
A vulnerability in Apache Tomcat related to improper resource shutdown or release allows for a 'made you reset' attack. This affects versions from 11.0.0-M1 to 11.0.9, from 10.1.0-M1 to 10.1.43, and from 9.0.0.M1 to 9.0.107.
Original NVD description (English source)
Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector. This issue affects Apache Tomcat: from 9.0.47 through 9.0.122. Users are recommended to upgrade to version 9.0.123, which fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS