CVE-2026-65183

Analyzed Analyzed - Analysis Complete

TOCTOU Race Condition in Apache Tomcat Unix Domain Socket Creation

Publication date: 2026-08-25

Last updated on: 2026-08-27

Assigner: Apache Software Foundation

Description

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.42 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-27

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-13

NVD

CVE-2026-65183

EUVD

EUVD-2026-66125

Affected Vendors & Products

Vendor	Product	Version / Range
apache	tomcat	From 10.1.0 (inc) to 10.1.58 (exc)
apache	tomcat	From 11.0.0 (inc) to 11.0.25 (exc)
apache	tomcat	From 9.0.42 (inc) to 9.0.121 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

Executive Summary

This is a Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat. It occurs when creating Unix domain sockets, allowing an unauthorized local user to access the socket due to a timing issue between checking and using a resource.

Detection Guidance

This vulnerability is a local Unix domain socket race condition in Apache Tomcat. Detection requires checking Tomcat versions and socket permissions. Use commands like 'ps aux | grep tomcat' to find Tomcat processes, then 'ls -l /proc/[PID]/fd' to inspect socket file descriptors. Verify Tomcat version with 'catalina.sh version' or check package managers like 'rpm -qa | grep tomcat' or 'dpkg -l | grep tomcat'.

Impact Analysis

An attacker with local access could exploit this to gain unauthorized access to Unix domain sockets, potentially leading to data breaches, privilege escalation, or unauthorized system operations on affected Tomcat servers.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations must patch to maintain compliance with data protection standards.

Mitigation Strategies

Upgrade Apache Tomcat to version 11.0.25, 10.1.58, or 9.0.121 or later immediately. Stop Tomcat services before upgrading. After upgrading, restart Tomcat and verify the new version is running. Monitor logs for unusual activity post-upgrade.

Hi! I’m here to help you understand CVE-2026-65183. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70