Log in Start free

Vulnerability · Published Oct 20, 2026 · Assigned by apache

CVE-2026-103119Apache Tomcat: AJP response mix-up

Critical 9.1

In plain English

A critical-severity security flaw in Apache Tomcat from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.6%top 51.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second. This issue affects Apache Tomcat: from 11.0.0-M25 through 11.0.26. Users are recommended to upgrade to version 11.0.27, which fixes the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13tomcat11no fix listedDEBIAN-CVE-2026-103119
Debian:14tomcat11no fix listedDEBIAN-CVE-2026-103119
Ubuntu:24.04:LTStomcat10no fix listedUBUNTU-CVE-2026-103119
Ubuntu:26.04:LTStomcat10no fix listedUBUNTU-CVE-2026-103119
Ubuntu:26.10tomcat10no fix listedUBUNTU-CVE-2026-103119
Ubuntu:26.04:LTStomcat11no fix listedUBUNTU-CVE-2026-103119
Ubuntu:26.10tomcat11no fix listedUBUNTU-CVE-2026-103119
Ubuntu:24.04:LTStomcat9no fix listedUBUNTU-CVE-2026-103119
Ubuntu:26.04:LTStomcat9no fix listedUBUNTU-CVE-2026-103119
Ubuntu:26.10tomcat9no fix listedUBUNTU-CVE-2026-103119

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Tomcat 11.0.0-M25 – through 11.0.26

Weakness: CWE-127 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References