CVE-2026-80353: Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector
Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector.
This issue affects Apache Tomcat: from 9.0.47 through 9.0.122.
Users are recommended to upgrade to version 9.0.123, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/tomcatto a version that resolves this vulnerability.Fixed in 9.0.123 - Upgrade
Upgrade
debian/tomcat9to a version that resolves this vulnerability.Fixed in 9.0.70-2 - Upgrade
Upgrade
debian/tomcat9to a version that resolves this vulnerability.Fixed in 9.0.70-2Fixed in 9.0.95-1Fixed in 9.0.122-1 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.123
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthorised local user can exploit the race condition to access a Unix domain socket created for Tomcat's APR/Native connector. The issue is relevant where that connector is used to create Unix domain sockets.
Are deployments using the NIO connector affected?
The described incomplete prior fix affected the APR/Native connector; the earlier fix for CVE-2026-65183 addressed the NIO connector. This issue specifically concerns the APR/Native connector.
Which Tomcat versions need remediation?
Apache Tomcat versions 9.0.47 through 9.0.122 are affected. Upgrade to 9.0.123, which fixes the issue.