CVE-2026-65183
published 2026-08-25CVE-2026-65183: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access…
PriorityP351high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
0.40%
32.9th percentile
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.42 through 9.0.120.
Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | — | — |
| apache | tomcat | >= 10.1.0 < 10.1.58 | 10.1.58 |
| apache | tomcat | >= 11.0.0 < 11.0.25 | 11.0.25 |
| apache | tomcat | >= 9.0.42 < 9.0.121 | 9.0.121 |
| apache_software_foundation | apache_tomcat | 9.0.47 – 9.0.122 | — |
| debian | tomcat10 | — | — |
| debian | tomcat11 | — | — |
| debian | tomcat9 | — | — |
| pki-deps_10.6 | pki-servlet-engine | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix dom
ghsa_unreviewed·2026-10-20·CVSS 8.1
CVE-2026-80353 [HIGH] CWE-367 Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix dom
Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector.
This issue affects Apache Tomcat: from 9.0.47 through 9.0.122.
Users are recommended to upgrade to version 9.0.123, which fixes the issue.
VulDB
Apache Tomcat up to 9.0.120/10.1.57/11.0.24 Unix Domain Socket toctou (Nessus ID 344996)
vuldb·2026-09-12·CVSS 8.1
CVE-2026-65183 [HIGH] Apache Tomcat up to 9.0.120/10.1.57/11.0.24 Unix Domain Socket toctou (Nessus ID 344996)
A vulnerability described as problematic has been identified in Apache Tomcat up to 9.0.120/10.1.57/11.0.24. The impacted element is an unknown function of the component Unix Domain Socket. The manipulation results in time-of-check time-of-use.
This vulnerability was named CVE-2026-65183. The attack needs to be approached locally. There is no available exploit.
Upgrading the affected component is recommended.
GHSA
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket.
ghsa_unreviewed·2026-08-26
CVE-2026-65183 CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket.
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.42 through 9.0.120.
Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
Red Hat
tomcat: Apache Tomcat: Local information disclosure via Unix domain socket TOCTOU race condition
vendor_redhat·2026-08-25·CVSS 8.1
CVE-2026-65183 [HIGH] CWE-367 tomcat: Apache Tomcat: Local information disclosure via Unix domain socket TOCTOU race condition
tomcat: Apache Tomcat: Local information disclosure via Unix domain socket TOCTOU race condition
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.42 through 9.0.120.
Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
A flaw was found in Apache Tomcat. A Time-of-check Time-of-use (TOCTOU) race condition exists when creating Unix domain sockets. This vulnerability allows an unauthorized local user to exploit the timing window to gain access to the Unix domain socket. This could lead to information disclosure or
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-80353 tomcat: tomcat: Unauthorized socket access via TOCTOU race condition
bugzilla·2026-10-20·CVSS 8.1
CVE-2026-80353 [HIGH] CVE-2026-80353 tomcat: tomcat: Unauthorized socket access via TOCTOU race condition
CVE-2026-80353 tomcat: tomcat: Unauthorized socket access via TOCTOU race condition
Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector.
This issue affects Apache Tomcat: from 9.0.47 through 9.0.122.
Users are recommended to upgrade to version 9.0.123, which fixes the issue.
Bugzilla
CVE-2026-65183 tomcat: Apache Tomcat: Local information disclosure via Unix domain socket TOCTOU race condition
bugzilla·2026-08-25·CVSS 8.1
CVE-2026-65183 [HIGH] CVE-2026-65183 tomcat: Apache Tomcat: Local information disclosure via Unix domain socket TOCTOU race condition
CVE-2026-65183 tomcat: Apache Tomcat: Local information disclosure via Unix domain socket TOCTOU race condition
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.42 through 9.0.120.
Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
2026-08-25
Published