Loading vulnerability…
Apache Tomcat Unix Domain Socket Permission Race
CVE-2026-65183 is a time-of-check/time-of-use (TOCTOU) race condition in Apache Tomcat during Unix domain socket creation and permission configuration. An unauthorized local user can exploit the race to access a socket that should be restricted. Affected versions are 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.42 through 9.0.120, inclusive. The fix addressed the NIO connector; the equivalent APR/Native connector issue is tracked separately as CVE-2026-80353.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits unauthorized local access to a Tomcat Unix domain socket, potentially exposing information or functionality reachable through that socket. The consequences depend on the connector and application configuration. Arbitrary code execution, privilege escalation, and unrestricted application authentication bypass are not established.
If you can’t patch tonight, do this now.
Until patched, restrict local account and shell access to trusted users. Place Unix domain sockets in directories with restrictive ownership and permissions that prevent untrusted users from reaching or interfering with socket creation. Review socket-directory access controls and monitor unexpected local processes accessing Tomcat sockets. These measures reduce exposure but do not replace the security update.
Patch, then assume compromise.
Upgrade Apache Tomcat to 11.0.25 or later, 10.1.58 or later, or 9.0.121 or later within the corresponding branch, or install the applicable vendor-maintained package update. These fixes address the NIO connector. Tomcat 9 deployments using the APR/Native connector should upgrade to 9.0.123 or later to resolve the separately tracked CVE-2026-80353; the original CVE-2026-65183 fix did not cover that connector.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
33 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.