CVE-2026-80353
Fixed in a distro release EPSS <1%
Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector. This issue affects Apache Tomcat: from 9.0.47 through 9.0.122. Users are recommended to upgrade to version 9.0.123, which fixes the issue.
Products: Apache Software Foundation Apache Tomcat
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian:12 | tomcat9 | 9.0.70-2 |
| Debian:13 | tomcat9 | 9.0.70-2 |
| Debian:14 | tomcat9 | 9.0.70-2 |
| Ubuntu:24.04:LTS | tomcat10 | no fix |
| Ubuntu:24.04:LTS | tomcat9 | no fix |
| Ubuntu:26.04:LTS | tomcat10 | no fix |
| Ubuntu:26.04:LTS | tomcat11 | no fix |
| Ubuntu:26.04:LTS | tomcat9 | no fix |
| Ubuntu:26.10 | tomcat10 | no fix |
| Ubuntu:26.10 | tomcat11 | no fix |
| Ubuntu:26.10 | tomcat9 | no fix |
| Ubuntu:Pro:14.04:LTS | tomcat6 | no fix |
| Ubuntu:Pro:14.04:LTS | tomcat7 | no fix |
| Ubuntu:Pro:16.04:LTS | tomcat7 | no fix |
| Ubuntu:Pro:16.04:LTS | tomcat8 | no fix |
| Ubuntu:Pro:18.04:LTS | tomcat8 | no fix |
| Ubuntu:Pro:18.04:LTS | tomcat9 | no fix |
| Ubuntu:Pro:20.04:LTS | tomcat9 | no fix |
| Ubuntu:Pro:22.04:LTS | tomcat9 | no fix |
| openSUSE:Tumbleweed | tomcat | 9.0.123-1.1 |