Loading vulnerability…
AJP response mix-up in Apache Tomcat
CVE-2026-103119 is a buffer under-read vulnerability in Apache Tomcat's AJP response handling, affecting versions 11.0.0-M25 through 11.0.26 inclusive. During a large non-blocking write, a response body can be split between the current request and the next request received on the same connection. This can cause the subsequent request to fail and potentially disclose data from the preceding response. Apache rates the vulnerability Important.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The subsequent request on an affected connection is likely to fail, disrupting request processing. Data belonging to the preceding response may also be delivered with the subsequent response, potentially exposing sensitive information to an unintended recipient. The vulnerability-specific CVSS assessment identifies confidentiality and availability impacts, with no integrity impact.
If you can’t patch tonight, do this now.
No vulnerability-specific interim workaround is documented. Upgrading to a fixed release is the recommended corrective action.
Patch, then assume compromise.
Upgrade affected Apache Tomcat 11 installations to version 11.0.27 or a later fixed release. For distribution-managed installations, verify that the installed package includes the fix; an upstream fixed release does not establish that a distribution package has been patched.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.