Vulnerability in Apache Software Foundation Apache Tomcat

[ Description ]Official description

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.42 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.

[ Fixes ]Fixes and patches

• Security bulletin: Apache Tomcat Apache_Tomcat_11.0.27Vendor patch or bulletin · CERT-FR · tomcat.apache.org/security-11.html, cited by CERT-FR CERTFR-2026-AVI-1358
• Security bulletin: Apache Tomcat Apache_Tomcat_10.1.61Vendor patch or bulletin · CERT-FR · tomcat.apache.org/security-10.html, cited by CERT-FR CERTFR-2026-AVI-1358
• Security bulletin: Apache Tomcat Apache_Tomcat_9.0.123Vendor patch or bulletin · CERT-FR · tomcat.apache.org/security-9.html, cited by CERT-FR CERTFR-2026-AVI-1358

[ Advisories ]Government CERT advisories

• CERT-FR21 Oct 2026CERTFR-2026-AVI-1358

  Multiple vulnerabilities in Apache Tomcat Translated from French

  Multiple vulnerabilities have been discovered in Apache Tomcat. Some of them allow an attacker to cause a breach of data confidentiality, a security policy bypass and a security problem not specified by the vendor.

  CVE-2026-65183CVE-2026-88041CVE-2026-80353+6 more CVEs
• BSI CERT-Bund20 Oct 2026WID-SEC-2026-4056

  Atlassian products (Bamboo, Bitbucket, Confluence, Crucible, Fisheye and Jira): Multiple vulnerabilities Translated from German

  CVE-2026-13676CVE-2026-50750CVE-2026-53404+72 more CVEs
• CERT-FR16 Oct 2026CERTFR-2026-AVI-1336

  Multiple vulnerabilities in IBM products Translated from French

  Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

  CVE-2026-14671CVE-2026-11548CVE-2022-22950+490 more CVEs
• CERT-FR2 Oct 2026CERTFR-2026-AVI-1249

  Multiple vulnerabilities in VMware products Translated from French

  Multiple vulnerabilities have been discovered in VMware products. They allow an attacker to cause a security problem not specified by the vendor.

  CVE-2026-75595CVE-2026-53910CVE-2026-56404+288 more CVEs
• CERT-FR2 Oct 2026CERTFR-2026-AVI-1256

  Multiple vulnerabilities in IBM products Translated from French

  Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

  CVE-2026-27980CVE-2026-58055CVE-2026-49978+360 more CVEs
• BSI CERT-Bund27 Sep 2026WID-SEC-2026-3595

  IBM QRadar SIEM: Multiple vulnerabilities Translated from German

  CVE-2025-54518CVE-2026-44186CVE-2026-59878+151 more CVEs

[ References ]References

• lists.apache.org/thread/748o4st6d5dk6n3l7tgzo5yl68gg05c0vendor-advisory