CVE catalog

CVE-2026-80353

tomcat9: CVE-2026-80353

[CVE catalog]

Severity
Low · CVSS 3.6CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.15% · Oct 25, 2026

Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector. This issue affects Apache Tomcat: from 9.0.47 through 9.0.122. Users are recommended to upgrade to version 9.0.123, which fixes the issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiantomcat9sid9.0.122-1fixed
Debiantomcat9forky9.0.122-1fixed
Debiantomcat9trixie9.0.95-1fixed
Debiantomcat9bookworm9.0.70-2fixed
Ubuntutomcat6pro6.0.37-1vulnerable
Ubuntutomcat6pro6.0.39-1vulnerable
Ubuntutomcat6pro6.0.39-1ubuntu0.1vulnerable
Ubuntutomcat6pro6.0.39-1ubuntu0.1+esm1vulnerable
Ubuntutomcat6pro6.0.39-1ubuntu0.1+esm2vulnerable
Ubuntutomcat6pro6.0.39-1ubuntu0.1+esm3vulnerable
Ubuntutomcat7pro7.0.64-1vulnerable
Ubuntutomcat7pro7.0.68-1vulnerable
Ubuntutomcat7pro7.0.68-1ubuntu0.1vulnerable
Ubuntutomcat7pro7.0.68-1ubuntu0.3vulnerable
Ubuntutomcat7pro7.0.68-1ubuntu0.4vulnerable
Ubuntutomcat7pro7.0.68-1ubuntu0.4+esm1vulnerable
Ubuntutomcat7pro7.0.68-1ubuntu0.4+esm2vulnerable
Ubuntutomcat7pro7.0.68-1ubuntu0.4+esm3vulnerable
Ubuntutomcat7pro7.0.68-1ubuntu0.4+esm4vulnerable
Ubuntutomcat8pro8.5.21-1ubuntu1vulnerable
Ubuntutomcat8pro8.5.29-1vulnerable
Ubuntutomcat8pro8.5.30-1vulnerable
Ubuntutomcat8pro8.5.30-1ubuntu1vulnerable
Ubuntutomcat8pro8.5.30-1ubuntu1.2vulnerable
Ubuntutomcat8pro8.5.30-1ubuntu1.3vulnerable
Ubuntutomcat8pro8.5.30-1ubuntu1.4vulnerable
Ubuntutomcat8pro8.5.39-1ubuntu1~18.04.1vulnerable
Ubuntutomcat8pro8.5.39-1ubuntu1~18.04.2vulnerable
Ubuntutomcat8pro8.5.39-1ubuntu1~18.04.3vulnerable
Ubuntutomcat8pro8.5.39-1ubuntu1~18.04.3+esm1vulnerable
Ubuntutomcat8pro8.5.39-1ubuntu1~18.04.3+esm2vulnerable
Ubuntutomcat8pro8.5.39-1ubuntu1~18.04.3+esm3vulnerable
Ubuntutomcat8pro8.5.39-1ubuntu1~18.04.3+esm4vulnerable
Ubuntutomcat8pro8.5.39-1ubuntu1~18.04.3+esm5vulnerable
Ubuntutomcat8pro8.5.39-1ubuntu1~18.04.3+esm6vulnerable
Ubuntutomcat9pro9.0.43-3vulnerable
Ubuntutomcat9pro9.0.54-1vulnerable
Ubuntutomcat9pro9.0.55-1vulnerable
Ubuntutomcat9pro9.0.58-1vulnerable
Ubuntutomcat9pro9.0.58-1ubuntu0.1vulnerable
Ubuntutomcat9pro9.0.58-1ubuntu0.1+esm1vulnerable
Ubuntutomcat9pro9.0.58-1ubuntu0.1+esm2vulnerable
Ubuntutomcat9pro9.0.58-1ubuntu0.1+esm3vulnerable
Ubuntutomcat9pro9.0.58-1ubuntu0.1+esm4vulnerable
Ubuntutomcat9pro9.0.58-1ubuntu0.2vulnerable
Ubuntutomcat9pro9.0.58-1ubuntu0.2+esm1vulnerable
Ubuntutomcat9pro9.0.58-1ubuntu0.2+esm2vulnerable
Ubuntutomcat9pro9.0.58-1ubuntu0.2+esm3vulnerable
Ubuntutomcat9pro9.0.58-1ubuntu0.2+esm4vulnerable
Ubuntutomcat1024.0410.1.10-1vulnerable
Ubuntutomcat1024.0410.1.14-1vulnerable
Ubuntutomcat1024.0410.1.15-1vulnerable
Ubuntutomcat1024.0410.1.16-1vulnerable
Ubuntutomcat1024.0410.1.16-1ubuntu0.1~esm1vulnerable
Ubuntutomcat1024.0410.1.16-1ubuntu0.1~esm2vulnerable
Ubuntutomcat1024.0410.1.16-1ubuntu0.1~esm3vulnerable
Ubuntutomcat1024.0410.1.16-1ubuntu0.1~esm4vulnerable
Ubuntutomcat1024.0410.1.55-1ubuntu2~24.04.1vulnerable
Ubuntutomcat924.049.0.70-1ubuntu1vulnerable
Ubuntutomcat924.049.0.70-2vulnerable
Ubuntutomcat924.049.0.70-2ubuntu0.1vulnerable
Ubuntutomcat924.049.0.70-2ubuntu0.1+esm1vulnerable
Ubuntutomcat924.049.0.70-2ubuntu0.1+esm2vulnerable
Ubuntutomcat924.049.0.70-2ubuntu0.1+esm3vulnerable
Ubuntutomcat924.049.0.118-1~24.04.1vulnerable
Ubuntutomcat1026.1010.1.40-1ubuntu1vulnerable
Ubuntutomcat1026.1010.1.54-1vulnerable
Ubuntutomcat1026.1010.1.54-1ubuntu1vulnerable
Ubuntutomcat1026.1010.1.54-1ubuntu2vulnerable
Ubuntutomcat1026.1010.1.55-1ubuntu1vulnerable
Ubuntutomcat1026.1010.1.55-1ubuntu2vulnerable
Ubuntutomcat1026.1010.1.57~us1-0ubuntu1vulnerable
Ubuntutomcat1126.1011.0.18-1vulnerable
Ubuntutomcat1126.1011.0.22-2vulnerable
Ubuntutomcat1126.1011.0.22-2ubuntu1vulnerable
Ubuntutomcat1126.1011.0.22-2ubuntu2vulnerable
Ubuntutomcat1126.1011.0.24-1ubuntu1vulnerable
Ubuntutomcat926.109.0.115-1vulnerable
Ubuntutomcat926.109.0.115-1ubuntu1vulnerable
Ubuntutomcat926.109.0.118-1vulnerable
Ubuntutomcat1026.0410.1.40-1ubuntu1vulnerable
Ubuntutomcat1026.0410.1.40-1ubuntu1.26.04.1vulnerable
Ubuntutomcat1026.0410.1.55-1ubuntu2~26.04.1vulnerable
Ubuntutomcat926.049.0.95-1ubuntu1vulnerable
Ubuntutomcat926.049.0.111-1vulnerable
Ubuntutomcat926.049.0.115-1vulnerable
Ubuntutomcat926.049.0.115-1ubuntu0.1vulnerable
Ubuntutomcat926.049.0.118-1~26.04.1vulnerable
Ubuntutomcat1126.0411.0.6-1vulnerable
Ubuntutomcat1126.0411.0.11-1vulnerable
Ubuntutomcat1126.0411.0.15-1vulnerable
Ubuntutomcat1126.0411.0.18-1vulnerable
Ubuntutomcat1126.0411.0.18-1ubuntu0.1~esm1vulnerable
Ubuntutomcat1126.0411.0.22-2ubuntu2~26.04.1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiantomcat9sourcesid9.0.70-2not yet assignedNot reportedNot reported
Debiantomcat9sourceforky9.0.70-2not yet assignedNot reportedNot reported
Debiantomcat9sourcetrixie9.0.70-2not yet assignedNot reportedNot reported
Debiantomcat9sourcebookworm9.0.70-2not yet assignedNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libtomcat9-java]Fixed

    Source package: [tomcat9]

    Details (2)

    • 9.0.70-2 · all · bookworm

      Fixed · Fixed: 9.0.70-2

      dsa · tomcat9 · debian · bookworm; dsa · tomcat9 · debian · 12

    • 9.0.70-2 · all · bookworm

      Fixed · Fixed: 9.0.70-2

      dsa · tomcat9 · debian · bookworm; dsa · tomcat9 · debian · 12

[Debian 13 (Trixie)]

  • [libtomcat9-java]Fixed

    Source package: [tomcat9]

    Details (2)

    • 9.0.95-1 · all · trixie

      Fixed · Fixed: 9.0.70-2

      dsa · tomcat9 · debian · 13

    • 9.0.95-1 · all · trixie

      Fixed · Fixed: 9.0.70-2

      dsa · tomcat9 · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]