CVE-2026-80353
—UnscoredPublished 20 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- —
- Complexity
- —
- Privileges needed
- —
- User interaction
- —
- Impact
- —
- Weakness
- CWE-367
Impact
Local unprivileged users can hijack or access UNIX domain sockets handled by the APR/Native connector. Attackers must already have local shell or code execution on the host.
Root cause
A time-of-check to time-of-use (TOCTOU) race condition occurs when creating UNIX domain sockets for the APR/Native connector.
Affected systems
Apache Tomcat 9.0.47 through 9.0.122
Fix & remediation
Upgrade to Apache Tomcat 9.0.123 or switch from the APR/Native connector to the NIO connector as a temporary workaround.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector. This issue affects Apache Tomcat: from 9.0.47 through 9.0.122. Users are recommended to upgrade to version 9.0.123, which fixes the issue.