CVE-2026-80353 Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connec
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-80353?
CVE-2026-80353 is a high-severity vulnerability in Apache Tomcat, published on 20 Oct 2026.
Official description
Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector.
This issue affects Apache Tomcat: from 9.0.47 through 9.0.122.
Users are recommended to upgrade to version 9.0.123, which fixes the issue.
Weakness: CWE-367
Which versions are affected by CVE-2026-80353?
1 open source package ship an affected version, including tomcat.
| Package | Affected | Fixed in |
|---|---|---|
tomcat Bitnami | From 9.0.47 | 9.0.123 |
How do I fix CVE-2026-80353?
Upgrade tomcat to 9.0.123 or later.
Is CVE-2026-80353 being exploited?
There is no known exploitation of CVE-2026-80353 in the wild and no public exploit code.
Sources
Also known as BIT-tomcat-2026-80353, DEBIAN-CVE-2026-80353, GHSA-wv4g-r8pf-3wmw, UBUNTU-CVE-2026-80353.