CVE-2026-80353: Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector

Q: Who can exploit this issue?

An unauthorised local user can exploit the race condition to access a Unix domain socket created for Tomcat's APR/Native connector. The issue is relevant where that connector is used to create Unix domain sockets.

Q: Are deployments using the NIO connector affected?

The described incomplete prior fix affected the APR/Native connector; the earlier fix for CVE-2026-65183 addressed the NIO connector. This issue specifically concerns the APR/Native connector.

Q: Which Tomcat versions need remediation?

Apache Tomcat versions 9.0.47 through 9.0.122 are affected. Upgrade to 9.0.123, which fixes the issue.

Published Oct 20, 2026

Updated

Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector.

This issue affects Apache Tomcat: from 9.0.47 through 9.0.122.

Users are recommended to upgrade to version 9.0.123, which fixes the issue.

Affected Software

1 affected component

Apache Tomcat>=9.0.47<=9.0.122

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Tomcat to a version that resolves this vulnerability.
Fixed in 9.0.123

Event History

Oct 20, 2026

CVE Published

via MITRE·01:42 PM

Data Sourced

via MITRE·01:42 PM

DescriptionWeakness

Data Sourced

via NVD·02:17 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthorised local user can exploit the race condition to access a Unix domain socket created for Tomcat's APR/Native connector. The issue is relevant where that connector is used to create Unix domain sockets.

Are deployments using the NIO connector affected?

The described incomplete prior fix affected the APR/Native connector; the earlier fix for CVE-2026-65183 addressed the NIO connector. This issue specifically concerns the APR/Native connector.

Which Tomcat versions need remediation?

Apache Tomcat versions 9.0.47 through 9.0.122 are affected. Upgrade to 9.0.123, which fixes the issue.

CVE-2026-80353: Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are deployments using the NIO connector affected?

Which Tomcat versions need remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are deployments using the NIO connector affected?

Which Tomcat versions need remediation?