CVE catalog

CVE-2026-103119

UBUNTU-CVE-2026-103119

[CVE catalog]

Severity
Unknown · CVSS 4.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.59% · Oct 25, 2026

Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second. This issue affects Apache Tomcat: from 11.0.0-M25 through 11.0.26. Users are recommended to upgrade to version 11.0.27, which fixes the issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiantomcat111311.0.11-1vulnerable
Debiantomcat111311.0.15-1vulnerable
Debiantomcat111311.0.15-1~deb13u1vulnerable
Debiantomcat111311.0.18-1vulnerable
Debiantomcat111311.0.21-1vulnerable
Debiantomcat111311.0.22-1vulnerable
Debiantomcat111311.0.22-1~deb13u1vulnerable
Debiantomcat111311.0.22-2vulnerable
Debiantomcat111311.0.24-1vulnerable
Debiantomcat111311.0.6-1vulnerable
Debiantomcat111411.0.11-1vulnerable
Debiantomcat111411.0.15-1vulnerable
Debiantomcat111411.0.15-1~deb13u1vulnerable
Debiantomcat111411.0.18-1vulnerable
Debiantomcat111411.0.21-1vulnerable
Debiantomcat111411.0.22-1vulnerable
Debiantomcat111411.0.22-1~deb13u1vulnerable
Debiantomcat111411.0.22-2vulnerable
Debiantomcat111411.0.24-1vulnerable
Debiantomcat111411.0.6-1vulnerable
Ubuntutomcat6pro6.0.37-1vulnerable
Ubuntutomcat6pro6.0.39-1vulnerable
Ubuntutomcat6pro6.0.39-1ubuntu0.1vulnerable
Ubuntutomcat6pro6.0.39-1ubuntu0.1+esm1vulnerable
Ubuntutomcat6pro6.0.39-1ubuntu0.1+esm2vulnerable
Ubuntutomcat6pro6.0.39-1ubuntu0.1+esm3vulnerable
Ubuntutomcat7pro7.0.64-1vulnerable
Ubuntutomcat7pro7.0.68-1vulnerable
Ubuntutomcat7pro7.0.68-1ubuntu0.1vulnerable
Ubuntutomcat7pro7.0.68-1ubuntu0.3vulnerable
Ubuntutomcat7pro7.0.68-1ubuntu0.4vulnerable
Ubuntutomcat7pro7.0.68-1ubuntu0.4+esm1vulnerable
Ubuntutomcat7pro7.0.68-1ubuntu0.4+esm2vulnerable
Ubuntutomcat7pro7.0.68-1ubuntu0.4+esm3vulnerable
Ubuntutomcat7pro7.0.68-1ubuntu0.4+esm4vulnerable
Ubuntutomcat8pro8.5.21-1ubuntu1vulnerable
Ubuntutomcat8pro8.5.29-1vulnerable
Ubuntutomcat8pro8.5.30-1vulnerable
Ubuntutomcat8pro8.5.30-1ubuntu1vulnerable
Ubuntutomcat8pro8.5.30-1ubuntu1.2vulnerable
Ubuntutomcat8pro8.5.30-1ubuntu1.3vulnerable
Ubuntutomcat8pro8.5.30-1ubuntu1.4vulnerable
Ubuntutomcat8pro8.5.39-1ubuntu1~18.04.1vulnerable
Ubuntutomcat8pro8.5.39-1ubuntu1~18.04.2vulnerable
Ubuntutomcat8pro8.5.39-1ubuntu1~18.04.3vulnerable
Ubuntutomcat8pro8.5.39-1ubuntu1~18.04.3+esm1vulnerable
Ubuntutomcat8pro8.5.39-1ubuntu1~18.04.3+esm2vulnerable
Ubuntutomcat8pro8.5.39-1ubuntu1~18.04.3+esm3vulnerable
Ubuntutomcat8pro8.5.39-1ubuntu1~18.04.3+esm4vulnerable
Ubuntutomcat8pro8.5.39-1ubuntu1~18.04.3+esm5vulnerable
Ubuntutomcat8pro8.5.39-1ubuntu1~18.04.3+esm6vulnerable
Ubuntutomcat9pro9.0.43-3vulnerable
Ubuntutomcat9pro9.0.54-1vulnerable
Ubuntutomcat9pro9.0.55-1vulnerable
Ubuntutomcat9pro9.0.58-1vulnerable
Ubuntutomcat9pro9.0.58-1ubuntu0.1vulnerable
Ubuntutomcat9pro9.0.58-1ubuntu0.1+esm1vulnerable
Ubuntutomcat9pro9.0.58-1ubuntu0.1+esm2vulnerable
Ubuntutomcat9pro9.0.58-1ubuntu0.1+esm3vulnerable
Ubuntutomcat9pro9.0.58-1ubuntu0.1+esm4vulnerable
Ubuntutomcat9pro9.0.58-1ubuntu0.2vulnerable
Ubuntutomcat9pro9.0.58-1ubuntu0.2+esm1vulnerable
Ubuntutomcat9pro9.0.58-1ubuntu0.2+esm2vulnerable
Ubuntutomcat9pro9.0.58-1ubuntu0.2+esm3vulnerable
Ubuntutomcat9pro9.0.58-1ubuntu0.2+esm4vulnerable
Ubuntutomcat1024.0410.1.10-1vulnerable
Ubuntutomcat1024.0410.1.14-1vulnerable
Ubuntutomcat1024.0410.1.15-1vulnerable
Ubuntutomcat1024.0410.1.16-1vulnerable
Ubuntutomcat1024.0410.1.16-1ubuntu0.1~esm1vulnerable
Ubuntutomcat1024.0410.1.16-1ubuntu0.1~esm2vulnerable
Ubuntutomcat1024.0410.1.16-1ubuntu0.1~esm3vulnerable
Ubuntutomcat1024.0410.1.16-1ubuntu0.1~esm4vulnerable
Ubuntutomcat1024.0410.1.55-1ubuntu2~24.04.1vulnerable
Ubuntutomcat924.049.0.70-1ubuntu1vulnerable
Ubuntutomcat924.049.0.70-2vulnerable
Ubuntutomcat924.049.0.70-2ubuntu0.1vulnerable
Ubuntutomcat924.049.0.70-2ubuntu0.1+esm1vulnerable
Ubuntutomcat924.049.0.70-2ubuntu0.1+esm2vulnerable
Ubuntutomcat924.049.0.70-2ubuntu0.1+esm3vulnerable
Ubuntutomcat924.049.0.118-1~24.04.1vulnerable
Ubuntutomcat1026.1010.1.40-1ubuntu1vulnerable
Ubuntutomcat1026.1010.1.54-1vulnerable
Ubuntutomcat1026.1010.1.54-1ubuntu1vulnerable
Ubuntutomcat1026.1010.1.54-1ubuntu2vulnerable
Ubuntutomcat1026.1010.1.55-1ubuntu1vulnerable
Ubuntutomcat1026.1010.1.55-1ubuntu2vulnerable
Ubuntutomcat1026.1010.1.57~us1-0ubuntu1vulnerable
Ubuntutomcat1126.1011.0.18-1vulnerable
Ubuntutomcat1126.1011.0.22-2vulnerable
Ubuntutomcat1126.1011.0.22-2ubuntu1vulnerable
Ubuntutomcat1126.1011.0.22-2ubuntu2vulnerable
Ubuntutomcat1126.1011.0.24-1ubuntu1vulnerable
Ubuntutomcat926.109.0.115-1vulnerable
Ubuntutomcat926.109.0.115-1ubuntu1vulnerable
Ubuntutomcat926.109.0.118-1vulnerable
Ubuntutomcat1026.0410.1.40-1ubuntu1vulnerable
Ubuntutomcat1026.0410.1.40-1ubuntu1.26.04.1vulnerable
Ubuntutomcat1026.0410.1.55-1ubuntu2~26.04.1vulnerable
Ubuntutomcat926.049.0.95-1ubuntu1vulnerable
Ubuntutomcat926.049.0.111-1vulnerable
Ubuntutomcat926.049.0.115-1vulnerable
Ubuntutomcat926.049.0.115-1ubuntu0.1vulnerable
Ubuntutomcat926.049.0.118-1~26.04.1vulnerable
Ubuntutomcat1126.0411.0.6-1vulnerable
Ubuntutomcat1126.0411.0.11-1vulnerable
Ubuntutomcat1126.0411.0.15-1vulnerable
Ubuntutomcat1126.0411.0.18-1vulnerable
Ubuntutomcat1126.0411.0.18-1ubuntu0.1~esm1vulnerable
Ubuntutomcat1126.0411.0.22-2ubuntu2~26.04.1vulnerable

Fixed-version evidence

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [libtomcat11-embed-java]Affected

    Source package: [tomcat11]

    Details (4)

    • 11.0.22-1~deb13u1 · all · trixie

      Affected

      pypi · tomcat11 · debian · 13

    • 11.0.22-1~deb13u1 · all · trixie

      Affected

      pypi · tomcat11 · debian · 13

    • 11.0.22-1~deb13u1 · all · trixie-security

      Affected

      pypi · tomcat11 · debian · 13

    • 11.0.22-1~deb13u1 · all · trixie-security

      Affected

      pypi · tomcat11 · debian · 13

  • [libtomcat11-java]Affected

    Source package: [tomcat11]

    Details (4)

    • 11.0.22-1~deb13u1 · all · trixie

      Affected

      pypi · tomcat11 · debian · 13

    • 11.0.22-1~deb13u1 · all · trixie

      Affected

      pypi · tomcat11 · debian · 13

    • 11.0.22-1~deb13u1 · all · trixie-security

      Affected

      pypi · tomcat11 · debian · 13

    • 11.0.22-1~deb13u1 · all · trixie-security

      Affected

      pypi · tomcat11 · debian · 13

  • [tomcat11]Affected
    Details (4)

    • 11.0.22-1~deb13u1 · all · trixie

      Affected

      pypi · tomcat11 · debian · 13

    • 11.0.22-1~deb13u1 · all · trixie

      Affected

      pypi · tomcat11 · debian · 13

    • 11.0.22-1~deb13u1 · all · trixie-security

      Affected

      pypi · tomcat11 · debian · 13

    • 11.0.22-1~deb13u1 · all · trixie-security

      Affected

      pypi · tomcat11 · debian · 13

  • [tomcat11-admin]Affected

    Source package: [tomcat11]

    Details (4)

    • 11.0.22-1~deb13u1 · all · trixie

      Affected

      pypi · tomcat11 · debian · 13

    • 11.0.22-1~deb13u1 · all · trixie

      Affected

      pypi · tomcat11 · debian · 13

    • 11.0.22-1~deb13u1 · all · trixie-security

      Affected

      pypi · tomcat11 · debian · 13

    • 11.0.22-1~deb13u1 · all · trixie-security

      Affected

      pypi · tomcat11 · debian · 13

  • [tomcat11-common]Affected

    Source package: [tomcat11]

    Details (4)

    • 11.0.22-1~deb13u1 · all · trixie

      Affected

      pypi · tomcat11 · debian · 13

    • 11.0.22-1~deb13u1 · all · trixie

      Affected

      pypi · tomcat11 · debian · 13

    • 11.0.22-1~deb13u1 · all · trixie-security

      Affected

      pypi · tomcat11 · debian · 13

    • 11.0.22-1~deb13u1 · all · trixie-security

      Affected

      pypi · tomcat11 · debian · 13

  • [tomcat11-docs]Affected

    Source package: [tomcat11]

    Details (4)

    • 11.0.22-1~deb13u1 · all · trixie

      Affected

      pypi · tomcat11 · debian · 13

    • 11.0.22-1~deb13u1 · all · trixie

      Affected

      pypi · tomcat11 · debian · 13

    • 11.0.22-1~deb13u1 · all · trixie-security

      Affected

      pypi · tomcat11 · debian · 13

    • 11.0.22-1~deb13u1 · all · trixie-security

      Affected

      pypi · tomcat11 · debian · 13

  • [tomcat11-examples]Affected

    Source package: [tomcat11]

    Details (4)

    • 11.0.22-1~deb13u1 · all · trixie

      Affected

      pypi · tomcat11 · debian · 13

    • 11.0.22-1~deb13u1 · all · trixie

      Affected

      pypi · tomcat11 · debian · 13

    • 11.0.22-1~deb13u1 · all · trixie-security

      Affected

      pypi · tomcat11 · debian · 13

    • 11.0.22-1~deb13u1 · all · trixie-security

      Affected

      pypi · tomcat11 · debian · 13

  • [tomcat11-user]Affected

    Source package: [tomcat11]

    Details (4)

    • 11.0.22-1~deb13u1 · all · trixie

      Affected

      pypi · tomcat11 · debian · 13

    • 11.0.22-1~deb13u1 · all · trixie

      Affected

      pypi · tomcat11 · debian · 13

    • 11.0.22-1~deb13u1 · all · trixie-security

      Affected

      pypi · tomcat11 · debian · 13

    • 11.0.22-1~deb13u1 · all · trixie-security

      Affected

      pypi · tomcat11 · debian · 13

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]