---
id: "CVE-2026-103119"
kind: "vulnerability"
aliases: ["CVE-2026-103119"]
title: "Apache Tomcat: large non-blocking writes can leak response data across requests"
severity: "high"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Apache Tomcat", "fixed": ["11.0.27"], "affected": ">= 11.0.0-M25, <= 11.0.26", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ajp", "apache-tomcat", "java", "runtime", "self-hosted", "tomcat-11"]
not_affected_if: ["ajp-disabled", "default-config", "tomcat-10.1"]
published_at: "2026-10-20T14:16:56+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-23T23:20:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103119", "first_seen_at": "2026-10-23T21:57:20+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:20:11+00:00"}]
---

# Apache Tomcat: large non-blocking writes can leak response data across requests

Apache Tomcat 11.0.0-M25 to 11.0.26 has a buffer under-read in the AJP connector. A large non-blocking write can split the response body between the current request and the next request on the same connection. Most likely the second request fails. It may also receive part of the first response, which is a cross-user leak if the connection is shared, as it is behind a reverse proxy. Apache rates it Important. Reported 16 Sep 2026, public 20 Oct 2026, fixed in 11.0.27 (commit f13748ba).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apache Tomcat affected >= 11.0.0-M25, <= 11.0.26 fixed 11.0.27

## How to check

Run Tomcat 11 (check with bin/version.sh or catalina.sh version) at 11.0.0-M25 through 11.0.26? Then look for an AJP connector in conf/server.xml, such as <Connector protocol="AJP/1.3" ...> or org.apache.coyote.ajp.*. If none is enabled, the AJP path is not in use (AJP is not on by default in 11). Apache's page does not say whether other connectors are affected. That is unconfirmed.

## Fix

Upgrade to Tomcat 11.0.27 or later. Until then, disable the AJP connector or restrict it to a trusted proxy with a secret.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103119
- 2026-10-23T23:20:11+00:00 analyst — Tomcat's 11.x security page names this 'AJP response mix-up', rated Important (not Critical). It is limited to the AJP connector, so the NVD 9.1 looks too high for most deployments. The page has no 10.1 entry, so I treat 10.1.x as unaffected. No PoC or exploitation found. I did not search social posts.

## Documents

- [advisory] Apache Tomcat 11.x vulnerabilities (CVE-2026-101296, fixed in 11.0.27) https://tomcat.apache.org/security-11.html
- [mentions] NVD CVE-2026-103119 https://nvd.nist.gov/vuln/detail/CVE-2026-103119

## From the sources

Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second.



This issue affects Apache Tomcat: from 11.0.0-M25 through 11.0.26.



Users are recommended to upgrade to version 11.0.27, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_