CVE-2026-80353

Not scored yetLast modified Oct 20, 2026

Description

Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector.

This issue affects Apache Tomcat: from 9.0.47 through 9.0.122.

Users are recommended to upgrade to version 9.0.123, which fixes the issue.

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-367

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 20, 2026
Last modified: Oct 20, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-803548.1Authorization bypass through User-Controlled key vulnerability in Apache Camel K. An authorization vulnerability in custom resource resol CVE-2026-803555.4Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cross-Site Request Forgery (CSRF) vulnerability. An unauthentic CVE-2026-803567.3Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Exposure of Sensitive Information to an Unauthorized Actor vul CVE-2026-803577.0Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access CVE-2026-803585.1Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access CVE-2026-803596.8Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access CVE-2026-80367.8Improper input validation in NI-PAL may allow a local authenticated user to access arbitrary system memory, potentially leading to privilege CVE-2026-80379.8OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbi CVE-2026-803786.5IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to improper authori CVE-2026-803798.8IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutra CVE-2026-80386.4The Faces of Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'default' shortcode attribute in the 'facesofus CVE-2026-803807.1IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote attacker to perform unauthorized actions due to cross-site request forgery.