CVE-2026-103119
9.1CriticalPublished 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality, availability
- Weakness
- CWE-127
Impact
Remote, unauthenticated attackers can cause denial of service or read sensitive response data belonging to other users on shared connections. They only need network access to send requests over an active connection handling non-blocking writes.
Root cause
A buffer under-read during large non-blocking writes splits a response body across multiple requests on the same connection.
Affected systems
Apache Tomcat 11.0.0-M25 through 11.0.26
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Fix & remediation
Upgrade to Apache Tomcat 11.0.27. No interim mitigation is provided in the advisory.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second. This issue affects Apache Tomcat: from 11.0.0-M25 through 11.0.26. Users are recommended to upgrade to version 11.0.27, which fixes the issue.