CVE-2026-80353

Awaiting Analysis Awaiting Analysis - Queue

TOCTOU Race Condition in Apache Tomcat Unix Domain Socket Creation

Publication date: 2026-10-20

Last updated on: 2026-10-29

Assigner: Apache Software Foundation

Description

Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector. This issue affects Apache Tomcat: from 9.0.47 through 9.0.122. Users are recommended to upgrade to version 9.0.123, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-29

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-80353

EUVD

EUVD-2026-105006

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache Tomcat	9.0.47

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

Executive Summary

This is a time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating Unix domain sockets for the APR/Native connector. It allows an unauthorized local user to access the socket. The issue was not fully fixed in CVE-2026-65183, which only addressed the NIO connector.

Detection Guidance

This vulnerability is specific to Apache Tomcat's APR/Native connector and involves a race condition in unix domain socket creation. Detection requires checking Tomcat version and connector configuration. Inspect Tomcat logs for errors related to socket creation or permission issues. Verify if the APR/Native connector is enabled in server.xml.

Impact Analysis

An unauthorized local user could exploit this to access Unix domain sockets, potentially leading to unauthorized data access or manipulation on systems running affected Tomcat versions.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or other standards as it involves a local privilege escalation risk rather than data exposure or privacy violations. However, if exploited, it could lead to unauthorized access to system resources, potentially violating security policies required by these regulations.

Mitigation Strategies

Upgrade Apache Tomcat to version 9.0.123 or later to address the TOCTOU race condition in the APR/Native connector. After upgrading, restart Tomcat and verify the APR/Native connector is functioning correctly. Ensure no local users have unauthorized access to unix domain sockets.

Hi! I’m here to help you understand CVE-2026-80353. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...