CVE-2026-80353 in Tomcat
Summary
by MITRE • 10/20/2026
Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector.
This issue affects Apache Tomcat: from 9.0.47 through 9.0.122.
Users are recommended to upgrade to version 9.0.123, which fixes the issue.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified as CVE-2026-65183 represents a critical security flaw within Apache Tomcat specifically affecting the APR and Native connectors when they operate using Unix domain sockets. This defect is rooted in a classic Time-of-check time-of-use race condition, a category of software error where the state of an object changes between the moment it is verified for safety or access permissions and the moment it is actually utilized by the system. In this specific context, the vulnerability arises during the creation process of Unix domain sockets. The application performs a security check to verify that the socket file does not already exist or meets certain permission criteria before proceeding with its creation. However, due to the asynchronous nature of operating system scheduling and concurrent access patterns, an unprivileged local user can exploit this narrow temporal window to manipulate the filesystem state between these two steps.
The technical mechanism involves the attacker creating a symbolic link pointing to a sensitive file or directory at the expected location of the new socket before Tomcat completes its creation process. When Apache Tomcat subsequently attempts to create the Unix domain socket, it may inadvertently overwrite or interact with this symlinked target rather than creating an isolated socket in a secure temporary directory. This behavior allows an unauthorized local user who has write access to the parent directory where the socket is being created to intercept connections intended for the Tomcat service. By controlling the file that the socket points to, the attacker can potentially read sensitive data transmitted through the socket or inject malicious commands into the communication stream between Tomcat and backend services such as Apache HTTP Server when using mod_jk or similar connectors.
The operational impact of this vulnerability is significant because it bypasses standard local isolation boundaries. Unix domain sockets are often used for high-performance, low-latency inter-process communication on the same host, frequently carrying sensitive application data without encryption since they rely on operating system-level permissions for security. An attacker exploiting this race condition can achieve unauthorized access to these internal communications. This could lead to information disclosure of session tokens, authentication credentials, or proprietary business logic processed by Tomcat. Furthermore, depending on how the backend services handle incoming requests via the socket, there may be potential implications for service integrity and availability if malicious payloads are injected into the data stream.
This flaw affects Apache Tomcat versions ranging from 9.0.47 through 9.0.122. It is important to note that previous remediation efforts addressed similar race conditions in the NIO connector but failed to apply equivalent fixes to the APR and Native connectors, leaving this specific attack vector open. The vulnerability aligns with CWE-367, which defines Time-of-check time-of-use (TOCTOU) race conditions as a distinct class of software weaknesses involving improper synchronization or ordering of operations that leads to security bypasses. From an offensive perspective, this technique relates to ATT&CK tactics concerning privilege escalation and lateral movement within local environments where attackers seek to pivot from lower-privileged accounts to higher-privilege services by exploiting misconfigured inter-process communication channels.
To mitigate this risk, organizations running affected versions of Apache Tomcat must upgrade immediately to version 9.0.123 or later, which contains the necessary code changes to secure the socket creation process in the APR and Native connectors. The fix likely involves using atomic file operations such as O_EXCL flags during socket creation to ensure that a new file is created only if it does not already exist, thereby eliminating the race window. Additionally, administrators should review their deployment configurations to ensure that Unix domain sockets are created in directories with strict permissions accessible only by the Tomcat service user. Implementing mandatory access control systems like SELinux or AppArmor can further restrict socket creation paths and mitigate the impact of such vulnerabilities even if a code-level fix is delayed. Regular auditing of file system permissions around temporary directories used for IPC mechanisms remains a best practice to prevent similar TOCTOU exploits in other software components.