Loading vulnerability…
Unix Domain Socket Access Race in Apache Tomcat APR/Native Connector
CVE-2026-80353 is a time-of-check time-of-use (TOCTOU) race condition in the APR/Native connector of Apache Tomcat 9.0.47 through 9.0.122, inclusive. During Unix domain socket creation with configured permissions, an unauthorized local user can exploit a race window to access the socket. The earlier fix for CVE-2026-65183 addressed the equivalent issue only in the NIO connector, leaving the APR/Native connector vulnerable. Apache rates this vulnerability as Low severity.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthorized local user can gain access to a Unix domain socket created by the APR/Native connector, bypassing the intended socket access restrictions. Further consequences, such as code execution or access to specific application data, are not established.
Patch, then assume compromise.
Upgrade Apache Tomcat to version 9.0.123 or a later fixed release. Versions containing only the earlier NIO connector fix for CVE-2026-65183 do not resolve this APR/Native connector vulnerability.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.