AI and data stack advisories

Severe, 6 weeks977Projects326

977 severe, 6 weeks · 326 projects

Apache Software FoundationCVE-2026-80353

Apache Tomcat: race condition

Apache Software Foundation

CVE-2026-80353 · Published Oct 20, 2026 · updated Oct 29, 2026

High8.1
No fix yet
Apache Software Foundation advisory

Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector.

This issue affects Apache Tomcat: from 9.0.47 through 9.0.122.

Users are recommended to upgrade to version 9.0.123, which fixes the issue.

Affected versions

PackageAffectedFixed in
Apache Tomcat
Product
>= 9.0.47, <= 9.0.122No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from
CISA (its enrichment of the CVE record)
Weakness
CWE-367

More Apache Software Foundation advisories

All Apache Software Foundation
High 7.5Oct 20Apache Tomcat: incomplete cleanupCVE-2026-88041no fix yetHigh 7.5Oct 20Apache Tomcat: incomplete cleanupCVE-2026-93446no fix yetMedium 6.5Oct 20Not Failing Securely ('Failing Open') vulnerability in Apache TomcatCVE-2026-74048no fix yetMedium 6.1Oct 20Execution After Redirect (EAR) vulnerability in Apache TomcatCVE-2026-74049no fix yetHigh 7.5Oct 20Apache Cocoon: server-side request forgeryCVE-2026-108086no fix yetHigh 8.8Oct 20Apache Cocoon: SQL injectionCVE-2026-108087no fix yet