CVE-2026-103119
Received Received - Intake

Buffer Under-Read in Apache Tomcat

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Apache Software Foundation

Description
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second. This issue affects Apache Tomcat: from 11.0.0-M25 through 11.0.26. Users are recommended to upgrade to version 11.0.27, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-103119
EUVD
EUVD-2026-105012

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache Tomcat 11.0.0-M25

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-127 The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations prior to the targeted buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a buffer under-read vulnerability in Apache Tomcat where a large non-blocking write operation can cause the response body to be split between the current and next request on the same connection. This likely fails the second request and may leak data from the first response into the second.

Impact Analysis

The vulnerability can cause request failures and potential data leakage between responses. If exploited, it may disrupt services relying on Tomcat and expose sensitive information from one user's response to another.

Mitigation Strategies

Upgrade Apache Tomcat to version 11.0.27 or later to address the buffer under-read vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103119. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart