Live › vulnerability › CVE-2026-103119
Go to dashboardApache Tomcat 11.0.0-M25 to 11.0.26 has a buffer under-read in the AJP connector. A large non-blocking write can split the response body between the current request and the next request on the same connection. Most likely the second request fails. It may also receive part of the first response, which is a cross-user leak if the connection is shared, as it is behind a reverse proxy. Apache rates it Important. Reported 16 Sep 2026, public 20 Oct 2026, fixed in 11.0.27 (commit f13748ba).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Apache Tomcat | vendor | >= 11.0.0-M25, <= 11.0.26 | 11.0.27 |
11.0.0-M25 through 11.0.26? Then look for an AJP connector in conf/server.xml, such as <Connector protocol="AJP/1.3" ...> or org.apache.coyote.ajp.*11.0.27 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second.
This issue affects Apache Tomcat: from 11.0.0-M25 through 11.0.26.
Users are recommended to upgrade to version 11.0.27, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-103119")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.