{"id":"CVE-2026-103119","kind":"vulnerability","aliases":["CVE-2026-103119"],"related":[],"title":"Apache Tomcat: large non-blocking writes can leak response data across requests","description":"Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M25 through 11.0.26.\n\n\n\nUsers are recommended to upgrade to version 11.0.27, which fixes the issue.","summary":"Apache Tomcat 11.0.0-M25 to 11.0.26 has a buffer under-read in the AJP connector. A large non-blocking write can split the response body between the current request and the next request on the same connection. Most likely the second request fails. It may also receive part of the first response, which is a cross-user leak if the connection is shared, as it is behind a reverse proxy. Apache rates it Important. Reported 16 Sep 2026, public 20 Oct 2026, fixed in 11.0.27 (commit f13748ba).","severity":"high","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Apache Tomcat","fixed":["11.0.27"],"affected":">= 11.0.0-M25, <= 11.0.26","ecosystem":"vendor"}],"ecosystems":[],"tags":["ajp","apache-tomcat","java","runtime","self-hosted","tomcat-11"],"not_affected_if":["ajp-disabled","default-config","tomcat-10.1"],"how_to_check":"Run Tomcat 11 (check with bin/version.sh or catalina.sh version) at 11.0.0-M25 through 11.0.26? Then look for an AJP connector in conf/server.xml, such as <Connector protocol=\"AJP/1.3\" ...> or org.apache.coyote.ajp.*. If none is enabled, the AJP path is not in use (AJP is not on by default in 11). Apache's page does not say whether other connectors are affected. That is unconfirmed.","fix":"Upgrade to Tomcat 11.0.27 or later. Until then, disable the AJP connector or restrict it to a trusted proxy with a secret.","status":"open","published_at":"2026-10-20T14:16:56+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:39:31+00:00","updated_at":"2026-10-23T23:20:11+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-10-23T22:39:31Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Apache Tomcat to version 11.0.27 or later.","reach":"network","title":"Apache Tomcat: large non-blocking writes can leak response data across requests","impact":"medium","summary":"A buffer under-read in Apache Tomcat 11.0.0-M25 through 11.0.26 can split a response body between the current request and the next request on the same connection. The likely result is a failed second request, and possibly data from the first response being delivered to the second.","category":"runtime","who_cares":["apache-tomcat","java","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Response data from one request may be read by another client's request.","analyst_note":"Sources do not say which non-blocking write paths or deployments are affected or how to test for them; the NVD entry carries a 9.1 CVSS score that the description does not clearly justify, so check the Apache Tomcat security page for the official impact.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000493,"input_tokens":2975,"output_tokens":391,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources do not say which non-blocking write paths or deployments are affected or how to test for them; the NVD entry carries a 9.1 CVSS score that the description does not clearly justify, so check the Apache Tomcat security page for the official impact.","search":"'-103119':16A,19A '-11':32B '-2026':15A,18A '11.0.0':35B,186C '11.0.26':38B,189C '11.0.27':120B,197C '16':111B '20':115B '2026':113B,117B 'across':12A 'affect':182C 'ajp':22B,47B 'also':80B 'apach':1A,24B,33B,106B,129C,183C 'apache':20A 'apache-tomcat':23B 'behind':102B 'block':6A,53B,137C 'bodi':59B,144C 'buffer':41B,123C 'commit':121B 'connect':71B,96B,158C 'connector':48B 'could':139C 'cross':91B 'cross-us':90B 'current':62B,149C 'cve':14A,17A 'data':11A,172C 'f13748ba':122B 'fail':77B 'failur':163C 'first':85B,175C 'fix':118B,199C 'host':30B 'import':109B 'issu':181C,201C 'java':26B 'larg':3A,50B,134C 'lead':159C 'leak':9A,93B 'leakag':170C 'like':73B,161C 'm25':36B,187C 'may':79B 'meant':131C 'next':66B,153C 'non':5A,52B,136C 'non-block':4A,51B,135C 'oct':116B 'part':82B 'possibl':169C 'proxi':105B 'public':114B 'rate':107B 'read':44B,126C 'receiv':81B,155C 'recommend':192C 'report':110B 'request':13A,63B,67B,76B,150C,154C,167C 'respons':10A,58B,86B,143C,176C 'result':140C 'revers':104B 'runtim':27B 'second':75B,166C,179C 'self':29B 'self-host':28B 'sep':112B 'share':98B 'split':56B,146C 'tomcat':2A,21A,25B,31B,34B,130C,184C 'under-read':42B,124C 'upgrad':194C 'user':92B,190C 'version':196C 'vulner':127C 'write':7A,54B,138C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T14:16:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103119","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103119","severity":null,"published_at":"2026-10-20T14:16:56+00:00","modified_at":"2026-10-20T19:35:38+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-103119:419","url":null,"severity":null,"published_at":"2026-10-23T23:20:11+00:00","modified_at":"2026-10-23T23:20:11+00:00","first_seen_at":"2026-10-23T23:20:11+00:00","fetched_at":"2026-10-23T23:20:11+00:00","note":"Tomcat's 11.x security page names this 'AJP response mix-up', rated Important (not Critical). It is limited to the AJP connector, so the NVD 9.1 looks too high for most deployments. The page has no 10.1 entry, so I treat 10.1.x as unaffected. No PoC or exploitation found. I did not search social posts."}],"documents":[{"id":1891,"url":"https://tomcat.apache.org/security-11.html","title":"Apache Tomcat 11.x vulnerabilities (CVE-2026-101296, fixed in 11.0.27)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1892,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103119","title":"NVD CVE-2026-103119","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}