Skip to content
Fencer Vulns
high 8.1

CVE-2026-80353 json

Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector

published 2026-10-20 19 d ago modified 2026-10-30 9 d ago also BIT-tomcat-2026-80353 , EUVD-2026-105006

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 33%
public exploits
0
none known

Summary

Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector.

This issue affects Apache Tomcat: from 9.0.47 through 9.0.122.

Users are recommended to upgrade to version 9.0.123, which fixes the issue.

Patch / fix

  • bitnami tomcat 9.0.123
  • tomcat9 Debian 14, Debian 13, Debian 12 9.0.70-2

debian advisories DEBIAN-CVE-2026-80353

  • tomcat SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 9.0.123-150200.126.1
  • tomcat SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 9.0.123-3.182.2
  • libapr1 SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 1.6.5-4.13.1
  • libtcnative-1-0 SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 1.3.9-3.9.1

suse advisories SUSE-SU-2026:5116-1SUSE-SU-2026:4927-1

  • tomcat openSUSE Tumbleweed 9.0.123-1.1

opensuse advisories openSUSE-SU-2026:12254-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-80353 updated cvss 3.6

tomcat: tomcat: Unauthorized socket access via TOCTOU race condition

  • Red Hat Enterprise Linux 8 tomcat, tomcat-lib, tomcat-webapps, tomcat-el-3.0-api, pki-servlet-engine, tomcat-docs-webapp, +4 more Red Hat Enterprise Linux 9 tomcat, tomcat-lib, tomcat-webapps, tomcat-el-3.0-api, pki-servlet-engine, tomcat-docs-webapp, +4 more Red Hat Enterprise Linux 10 tomcat9 Red Hat JBoss Web Server 5 jws5-tomcat, jws5-tomcat-lib, jws5-tomcat-jsvc, jws5-tomcat-javadoc, jws5-tomcat-selinux, jws5-tomcat-webapps, +7 more
    affected: workaround, no fix available “Switch affected connectors from APR/Native to the standard NIO connector, or restrict local directory permissions on the socket's parent path to deny unprivileged local users traversal and access.”
  • Red Hat Hardened Images tomcat10 10.1.61-0.1.hum1, tomcat11 11.0.27-0.1.hum1, tomcat10-lib 10.1.61-0.1.hum1, tomcat11-lib 11.0.27-0.1.hum1, tomcat10-common 10.1.61-0.1.hum1, tomcat11-common 11.0.27-0.1.hum1, +14 more
    fixed: vendor fix “Switch affected connectors from APR/Native to the standard NIO connector, or restrict local directory permissions on the socket's parent path to deny unprivileged local users traversal and access.” RHSA-2026:85926
  • Red Hat Enterprise Linux 6 tomcat6, tomcat6-lib, tomcat6-log4j, tomcat6-javadoc, tomcat6-webapps, tomcat6-el-2.1-api, +4 more Red Hat Enterprise Linux 7 tomcat, tomcat-lib, tomcat-jsvc, tomcat-javadoc, tomcat-webapps, tomcat-el-2.2-api, +4 more Red Hat Enterprise Linux 10 tomcat Red Hat Hardened Images hi/tomcat Red Hat JBoss Web Server 6 jws6-tomcat, jws6-tomcat-lib, jws6-tomcat-javadoc, jws6-tomcat-selinux, jws6-tomcat-webapps, jws6-tomcat-el-5.0-api, +4 more Red Hat JBoss Web Server 7 jws7-tomcat
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
10 d ago

Exploit prediction

0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami tomcat
>=9.0.47, <9.0.123
9.0.123

Affected products

  • Apache Software Foundation Apache Tomcat

Classification

Weakness
  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.