BIT-tomcat-2026-80353: Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector
Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector.
This issue affects Apache Tomcat: from 9.0.47 through 9.0.122.
Users are recommended to upgrade to version 9.0.123, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/tomcatto a version that resolves this vulnerability.Fixed in 9.0.123 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.123
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthorised local user can exploit the race condition to access a Unix domain socket created by the APR/Native connector. The available information does not indicate that this is remotely exploitable.
Which Tomcat deployments are affected?
Apache Tomcat versions 9.0.47 through 9.0.122 are affected when creating Unix domain sockets with the APR/Native connector. The prior fix for CVE-2026-65183 addressed the NIO connector but not the APR/Native connector.
What is the remediation?
Upgrade Apache Tomcat to version 9.0.123, which fixes the issue.