Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-10-20T13:42:05 tomcat: tomcat: Unauthorized socket access via TOCTOU race condition 3.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N CWE-367

Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector. This issue affects Apache Tomcat: from 9.0.47 through 9.0.122. Users are recommended to upgrade to version 9.0.123, which fixes the issue.

A flaw was found in Apache Tomcat. A local attacker can gain unauthorized access to Unix domain communication sockets due to a time-of-check to time-of-use (TOCTOU) race condition in the APR/Native connector. When the connector initializes a socket, a brief timing window exists before restrictive permissions are applied, allowing an unauthorized local user to connect to the socket and potentially intercept or manipulate local service communications.

A flaw was found in Apache Tomcat. When initializing Unix domain sockets within the APR/Native connector, a time-of-check to time-of-use (TOCTOU) race condition exists before restrictive file permissions are enforced. An authenticated local attacker with shell access to the host system can exploit this timing window to establish an unauthorized connection to the socket, allowing them to intercept or inject data into local inter-process communications handled by the Tomcat daemon, constrained by DAC permissions and SELinux policy boundaries. Switch affected connectors from APR/Native to the standard NIO connector, or restrict local directory permissions on the socket's parent path to deny unprivileged local users traversal and access. Red Hat Hardened Images 2026-10-12T00:00:00Z RHSA-2026:81365 tomcat11-main-11.0.27-0.1.hum1 Red Hat Hardened Images 2026-10-20T00:00:00Z RHSA-2026:85926 tomcat10-main-10.1.61-0.1.hum1 Red Hat Enterprise Linux 10 Not affected tomcat Red Hat Enterprise Linux 10 Fix deferred tomcat9 Red Hat Enterprise Linux 6 Not affected tomcat6 Red Hat Enterprise Linux 7 Not affected tomcat Red Hat Enterprise Linux 8 Fix deferred pki-deps:10.6/pki-servlet-engine Red Hat Enterprise Linux 8 Fix deferred tomcat Red Hat Enterprise Linux 9 Fix deferred pki-servlet-engine Red Hat Enterprise Linux 9 Fix deferred tomcat Red Hat Hardened Images Not affected hi/tomcat Red Hat JBoss Web Server 5 Fix deferred jws5-tomcat Red Hat JBoss Web Server 6 Not affected jws6-tomcat Red Hat JBoss Web Server 7 Not affected jws7-tomcat https://www.cve.org/CVERecord?id=CVE-2026-80353 https://nvd.nist.gov/vuln/detail/CVE-2026-80353 https://lists.apache.org/thread.html/tr0q87qwvs80p9hc53tkwpzvnx0ywftr