CVE-2026-80353

The record

Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector. This issue affects Apache Tomcat: from 9.0.47 through 9.0.122. Users are recommended to upgrade to version 9.0.123, which fixes the issue.

Affected packages

Related vulnerabilities

• CVE-2026-116250 In server mode pgAdmin 4 validates a path a user gives for a file in their storage… CWE-367
• CVE-2026-116240 In server mode pgAdmin 4 validates a path into the user's storage directory with… CWE-367
• CVE-2026-115683 A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate… CWE-367
• CVE-2026-119552 Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup… CWE-367
• CVE-2026-92374 A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link… CWE-367
• CVE-2026-117603 Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet… CWE-367
• CVE-2026-75524 OpenReception's appointment booking software provides an end-to-end encrypted appointment… CWE-367
• CVE-2026-105481 A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a… CWE-367