CVE-2026-65183 Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets
A race condition in Apache Tomcat allows local attackers to bypass Unix domain socket permissions, potentially gaining unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-65183?
CVE-2026-65183 is a high-severity vulnerability in Apache Tomcat, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.42 through 9.0.120.
Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
Weakness: CWE-367
Which versions are affected by CVE-2026-65183?
1 open source package ship an affected version, including tomcat. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tomcat Bitnami | From 9.0.42 | 9.0.121, 10.1.58, 11.0.25 |
Products include Apache Tomcat.
How do I fix CVE-2026-65183?
Upgrade tomcat to a fixed version for your release line: 9.0.121, 10.1.58 or 11.0.25.
Is CVE-2026-65183 being exploited?
There is no known exploitation of CVE-2026-65183 in the wild and no public exploit code.
Other vulnerabilities in Apache Tomcat
Sources
Also known as BIT-tomcat-2026-65183, DEBIAN-CVE-2026-65183, GHSA-h3mr-2w3q-jcv9, MINI-5wjg-8f22-q277, MINI-65v6-4rj4-2jpm, MINI-prfx-58cw-5582 and 1 more.