CVE-2026-80353
Description
A flaw was found in Apache Tomcat. A local attacker can gain unauthorized access to Unix domain communication sockets due to a time-of-check to time-of-use (TOCTOU) race condition in the APR/Native connector. When the connector initializes a socket, a brief timing window exists before restrictive permissions are applied, allowing an unauthorized local user to connect to the socket and potentially intercept or manipulate local service communications.
Statement
A flaw was found in Apache Tomcat. When initializing Unix domain sockets within the APR/Native connector, a time-of-check to time-of-use (TOCTOU) race condition exists before restrictive file permissions are enforced. An authenticated local attacker with shell access to the host system can exploit this timing window to establish an unauthorized connection to the socket, allowing them to intercept or inject data into local inter-process communications handled by the Tomcat daemon, constrained by DAC permissions and SELinux policy boundaries.
Mitigation
Switch affected connectors from APR/Native to the standard NIO connector, or restrict local directory permissions on the socket's parent path to deny unprivileged local users traversal and access.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.6 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | Low | N/A | N/A |
| Integrity Impact | Low | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
