Race Condition in Apache Tomcat APR/Native Connector Vulnerable to Local Unauthorized Access

CVE-2026-80353

What is CVE-2026-80353?

A race condition vulnerability exists in the Apache Tomcat APR/Native connector when creating Unix domain sockets. This flaw enables unauthorized local users to gain access to the Unix domain socket, thereby compromising security. The previously addressed vulnerability CVE-2026-65183 only covered the NIO connector and did not resolve this specific issue with the APR/Native connector. Users are advised to update to version 9.0.123 or later to mitigate this vulnerability.

References