CVE-2026-80353: Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector

As cited

Copy frozen at 2026-10-20 19:25 UTC (site build).

vulnerabilities

CVE-2026-80353: Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector

A time-of-check time-of-use (TOCTOU) race condition in Apache Tomcat versions 9.0.47 through 9.0.122 allows an unauthorized local user to access unix domain sockets created by the APR/Native connector. The prior fix for CVE-2026-65183 addressed only the NIO connector, leaving the APR/Native connector vulnerable to the same issue.

Why it matters: Organizations running Apache Tomcat 9.0.47-9.0.122 with the APR/Native connector should upgrade or apply patches to prevent local privilege escalation or unauthorized socket access.

Source published

2026-10-20 17:19 UTC

First seen by Cybersecurity Tracker

2026-10-20 18:31 UTC