CVE-2026-80353 Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector
HighCVSS 8.1
EPSS 0.39%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector.
This issue affects Apache Tomcat: from 9.0.47 through 9.0.122.
Users are recommended to upgrade to version 9.0.123, which fixes the issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat/tomcat11-main(Red Hat:hummingbird:1) | < 11.0.27-0.1.hum1 | 11.0.27-0.1.hum1 |
| redhat/tomcat10-main(Red Hat:hummingbird:1) | < 10.1.61-0.1.hum1 | 10.1.61-0.1.hum1 |
| redhat/tomcat9(Red Hat:enterprise_linux:10) | All versions | No fix listed |
| redhat/pki-deps:10.6/pki-servlet-engine(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/tomcat(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/pki-servlet-engine(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/tomcat(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/jws5-tomcat(Red Hat:jboss_enterprise_web_server:5) | All versions | No fix listed |
| Apache Tomcat | >= 9.0.47, <= 9.0.122 | No fix listed |
| debian/tomcat9(Debian:12) | < 9.0.70-2 | 9.0.70-2 |
| debian/tomcat9(Debian:13) | < 9.0.70-2 | 9.0.70-2 |
| debian/tomcat9(Debian:14) | < 9.0.70-2 | 9.0.70-2 |
| ubuntu/tomcat9(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/tomcat10(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/tomcat9(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/tomcat10(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/tomcat9(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/tomcat11(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/tomcat10(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/tomcat11(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/tomcat9(Ubuntu:26.10) | All versions | No fix listed |
References
- Red Hat CVE page mitigation vendor-advisory
- RHSA-2026:81365 patch vendor-advisory
- RHSA-2026:85926 patch vendor-advisory
- Red Hat Bugzilla 2556183 issue-tracking
- www.cve.org
- nvd.nist.gov
- lists.apache.org vendor-advisory
- Debian Security Tracker CVE-2026-80353 vendor-advisory
- Ubuntu CVE tracker vendor-advisory