Live › vulnerability › CVE-2026-80353
Go to dashboardWhen Tomcat creates a Unix domain socket for the APR/Native connector, a race condition between the check and the creation step lets a local user access that socket. The fix for CVE-2026-65183 covered only the NIO connector, so the APR/Native connector remains exposed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Apache Tomcat 9.0.47 through 9.0.122 with the APR/Native connector and Unix domain sockets on a host where untrusted local users have shell access. Exposure needs a local account on the machine; remote network attackers are not described as able to exploit it. Deployments on the NIO connector only, or on Tomcat 10 and 11, are outside the stated range.
No product ranges from the sources yet.
catalina.sh version or check the Tomcat version in the server banner; affected range is 9.0.47 through 9.0.122Connector elements with protocol="org.apache.coyote.http11.Http11AprProtocol" or the APR library loaded in conf/server.xml9.0.123Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector.
This issue affects Apache Tomcat: from 9.0.47 through 9.0.122.
Users are recommended to upgrade to version 9.0.123, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-80353")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.