CVE-2026-80353 Apache Software Foundation CVE debrief

Who should care

Apache Tomcat users, system administrators, and security teams should assess exposure and prioritize remediation. Affected operator, platform, vulnerability-management, and security-team impact need to be evaluated. The TOCTOU vulnerability in the APR/Native connector requires immediate attention from those responsible for maintaining Apache Tomcat deployments. Those who manage Unix-based systems and Tomcat configurations should verify their exposure and

Why it matters

Apache Tomcat users should assess exposure and prioritize remediation due to a TOCTOU vulnerability in the APR/Native connector. The issue was not addressed by the fix for CVE-2026-65183 and affects versions 9.0.47 through 9.0.122. Upgrade to version 9.0.123 to fix the issue.

• Local unauthorized users may access Unix domain sockets
• Verify affected versions and apply the fix to prevent exploitation
• Remediation priority is high due to the TOCTOU nature of the vulnerability

Technical summary

A Time-of-check time-of-use (TOCTOU) race condition vulnerability exists in Apache Tomcat's APR/Native connector when creating Unix domain sockets. The fix for CVE-2026-65183 did not address this issue, which affects versions 9.0.47 through 9.0.122. Users are recommended to upgrade to version 9.0.123. The vulnerability allows unauthorized local users to access Unix domain sockets. The issue requires verification of affected versions and application of the fix to prevent exploitation. Remediation priority is high due to the TOCTOU nature of the vulnerability.

Defensive priority

High

Recommended defensive actions

• Assess exposure and prioritize remediation for Apache Tomcat versions 9.0.47 through 9.0.122
• Upgrade to Apache Tomcat version 9.0.123
• Verify affected versions and apply the fix
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the TOCTOU vulnerability in Apache Tomcat's APR/Native connector. The fix for CVE-2026-65183 did not address this issue, which affects versions 9.0.47 through 9.0.122.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.