CVE-2026-103119
published 2026-10-20CVE-2026-103119: Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current…
PriorityP359critical9.1CVSS 3.1
AVNACLPRNUINSUCHINAH
EPSS
0.61%
48.5th percentile
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second.
This issue affects Apache Tomcat: from 11.0.0-M25 through 11.0.26.
Users are recommended to upgrade to version 11.0.27, which fixes the issue.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache_software_foundation | apache_tomcat | 11.0.0-M25 – 11.0.26 | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vendor_redhat9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that c
ghsa_unreviewed·2026-10-20
CVE-2026-103119 [CRITICAL] CWE-127 Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that c
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second.
This issue affects Apache Tomcat: from 11.0.0-M25 through 11.0.26.
Users are recommended to upgrade to version 11.0.27, which fixes the issue.
Red Hat
tomcat: Apache Tomcat: Information disclosure via buffer under-read during non-blocking writes
vendor_redhat·2026-10-20·CVSS 9.1
CVE-2026-103119 [CRITICAL] CWE-125 tomcat: Apache Tomcat: Information disclosure via buffer under-read during non-blocking writes
tomcat: Apache Tomcat: Information disclosure via buffer under-read during non-blocking writes
A flaw was found in Apache Tomcat. During large non-blocking write operations, a buffer under-read can cause an HTTP response body to be split between the current request and the subsequent request handled on the same connection. A remote user sending a follow-up request could receive sensitive data intended for the prior response, leading to information disclosure. This issue can also cause the subsequent request to fail, resulting in a denial of service (DoS).
No detection rules found.
No public exploits indexed.
2026-10-20
Published