Description
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second.



This issue affects Apache Tomcat: from 11.0.0-M25 through 11.0.26.



Users are recommended to upgrade to version 11.0.27, which fixes the issue.
Published: 2026-10-20
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Potential Data Leakage
Action: Immediate Patch
AI Analysis

Impact

A buffer under‑read flaw in Apache Tomcat’s AJP connector allows a large non‑blocking write to split a response body across two consecutive requests, causing the second request to fail and possibly leaking data from the first response into the second. This vulnerability is classified as CWE‑127, representing an illegal read of memory outside the intended buffer boundaries.

Affected Systems

The flaw affects Apache Tomcat versions from 11.0.0‑M25 through 11.0.26 inclusive, as supplied by the Apache Software Foundation.

Risk and Exploitability

EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog, but the CVSS score of 9.1 indicates a high severity. The flaw allows a large non‑blocking write to split a response body across two consecutive requests, potentially causing the second request to fail and leaking data from the first response into the second. The likely attack vector is an attacker with network access to a vulnerable Tomcat instance who can trigger this scenario via the AJP interface, usually on port 8009, exposing sensitive response payloads to unintended clients and leading to confidentiality breaches.

Generated by OpenCVE AI on October 22, 2026 at 20:11 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch by upgrading to Apache Tomcat 11.0.27 or later
  • If the AJP connector is not required, disable it or bind it to localhost only and restrict access to trusted hosts
  • Configure the firewall to allow AJP traffic only from known, trusted IP addresses to reduce exposure

Generated by OpenCVE AI on October 22, 2026 at 20:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat hummingbird
Weaknesses CWE-125
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat
Redhat hummingbird
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 20 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache apache Tomcat
Apache tomcat
Apache Software Foundation
Apache Software Foundation tomcat
Vendors & Products Apache
Apache apache Tomcat
Apache tomcat
Apache Software Foundation
Apache Software Foundation tomcat

Tue, 20 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
Description Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second. This issue affects Apache Tomcat: from 11.0.0-M25 through 11.0.26. Users are recommended to upgrade to version 11.0.27, which fixes the issue.
Title Apache Tomcat: AJP response mix-up
Weaknesses CWE-127
References

Subscriptions

Apache Apache Tomcat Tomcat
Apache Software Foundation Tomcat
Redhat Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-20T18:09:52.183Z

Reserved: 2026-09-30T06:39:52.124Z

Link: CVE-2026-103119

cve-icon Vulnrichment

Updated: 2026-10-20T18:09:52.183Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T14:16:56.087

Modified: 2026-10-20T19:35:38.940

Link: CVE-2026-103119

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-20T13:54:13Z

Links: CVE-2026-103119 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T20:15:09Z

Weaknesses