Apache Tomcat contains a Time‑of‑Check Time‑of‑Use (TOCTOU) race condition in the code that creates Unix Domain Sockets. The flaw allows a local user who can exploit the race to access the socket after it is created, potentially enabling the user to send arbitrary commands or read data that should be restricted. This weakness is characterized by CWE-367 and results in unauthorized local access rather than remote code execution.

The vulnerability affects Apache Tomcat versions 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.42 through 9.0.120. These are provided by the Apache Software Foundation, and the affected product is the Tomcat application server.

The exploit requires a local user with file system permissions that allow the TOCTOU race. There is no known remote attack vector or public exploit, and no CVSS score or EPSS data are available, so the precise severity is unclear. The vulnerability is not listed in CISA KEV, indicating no public data about active exploitation. Nevertheless, any unauthorized local user could use the socket to communicate with Tomcat services or bypass authentication checks if the socket is bound to privileged services.