CVE-2026-65183 Details
Description
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.42 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
A Time-of-check Time-of-use (TOCTOU) race condition vulnerability has been identified in Apache Tomcat versions 11.0.0-M1 prior to 11.0.24, 10.1.0-M1 prior to 10.1.57, and 9.0.42 prior to 9.0.120. This vulnerability allows an unauthorized local user to access Unix domain sockets, potentially leading to unauthorized communication or data access. The issue arises when specific permissions are set for Unix domain sockets, creating a window of opportunity for exploitation.
Users are advised to upgrade to Apache Tomcat versions 11.0.25, 10.1.59, or 9.0.121. Note that while version 10.1.58 includes the fix, it is not listed as an affected version due to the release vote for this version not passing.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/08/26/2 | CVE | Third Party AdvisoryMailing List |
| https://lists.apache.org/thread/748o4st6d5dk6n3l7tgzo5yl68gg05c0 | [email protected] | Vendor AdvisoryMailing List |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache tomcat | >= 9.0.42, < 9.0.121 >= 10.1.0, < 10.1.58 >= 11.0.0, < 11.0.25 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 27, 2026 | Initial Analysis | [email protected] |
| Aug 26, 2026 | CVE Modified | CISA-ADP |
| Aug 26, 2026 | CVE Modified | [email protected] |
| Aug 26, 2026 | CVE Modified | CVE |
| Aug 25, 2026 | New CVE Received | [email protected] |