BIT-tomcat-2026-80353

    Dashboard / Vulnerabilities / BIT-tomcat-2026-80353

    BIT-tomcat-2026-80353

    Published: 29 Oct 2026Last Modified: 30 Oct 2026

    Summary: Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector

    Details: Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector. This issue affects Apache Tomcat: from 9.0.47 through 9.0.122. Users are recommended to upgrade to version 9.0.123, which fixes the issue.

    References: https://lists.apache.org/thread.html/tr0q87qwvs80p9hc53tkwpzvnx0ywftr, https://nvd.nist.gov/vuln/detail/CVE-2026-80353

    Affected packages

    Package

    Name: tomcat

    Purl: pkg:bitnami/tomcat

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 9.0.47
    Fixed -9.0.123

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    BIT-tomcat-2026-80353 | CVE-DB