Skip to content

[GHSA-wv4g-r8pf-3wmw] Time-of-check time-of-use (TOCTOU) race condition... #10511

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
taishikitamura wants to merge 1 commit into
base: taishikitamura/advisory-improvement-10511
Choose a base branch
from
Open

[GHSA-wv4g-r8pf-3wmw] Time-of-check time-of-use (TOCTOU) race condition... #10511

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
89 changes: 85 additions & 4 deletions advisories/unreviewed/2026/10/GHSA-wv4g-r8pf-3wmw/GHSA-wv4g-r8pf-3wmw.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,29 +1,110 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wv4g-r8pf-3wmw",
"modified": "2026-10-20T15:31:24Z",
"modified": "2026-10-20T15:31:25Z",
"published": "2026-10-20T15:31:24Z",
"aliases": [
"CVE-2026-80353"
],
"summary": "Apache Tomcat - TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector",
"details": "Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector.\n\n\n\nThis issue affects Apache Tomcat: from 9.0.47 through 9.0.122.\n\n\n\nUsers are recommended to upgrade to version 9.0.123, which fixes the issue.",
"severity": [],
"affected": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat-coyote"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.47"
},
{
"fixed": "9.0.123"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 9.0.122"
}
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat.embed:tomcat-embed-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.47"
},
{
"fixed": "9.0.123"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 9.0.122"
}
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.47"
},
{
"fixed": "9.0.123"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 9.0.122"
}
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80353"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/894158fd49679a6bd48d9689905829e1fdc45cb2"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/tr0q87qwvs80p9hc53tkwpzvnx0ywftr"
},
{
"type": "WEB",
"url": "https://tomcat.apache.org/security-9.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-367"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-20T14:17:03Z"
Expand Down
Loading