CVE-2026-80353CWE-367

CVE-2026-80353

published October 20, 2026

CVSS
—
EPSS
0%
Percentile
4.9
In the wild
Unconfirmed
What it is

Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector.

This issue affects Apache Tomcat: from 9.0.47 through 9.0.122.

Users are recommended to upgrade to version 9.0.123, which fixes the issue.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00161 · 4.9th percentile
Weakness
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition
Published
2026-10-20T18:17Z
References (1)
https://lists.apache.org/thread.html/tr0q87qwvs80p9hc53tkwpzvnx0ywftr · [email protected]
EPSS history
Timeline
  • 22 OCT 03:35Z
    EPSS moved — → 0%
    epss
  • 20 OCT 13:42Z
    Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector
    cvelistv5
  • 20 OCT 13:42Z
    Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector
    cvelistv5