{
  "from_raw": "Mark Thomas <markt@apache.org>",
  "from": "Mark Thomas <ma...@apache.org>",
  "gravatar": "2ecfd40ef69301d18d9f6067ce5d23b9",
  "to": "Tomcat Users List <us...@tomcat.apache.org>,\n \"announce@tomcat.apache.org\" <an...@tomcat.apache.org>,\n an...@apache.org,\n Tomcat Developers List <de...@tomcat.apache.org>",
  "subject": "[SECURITY] CVE-2026-80353 Apache Tomcat - TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector",
  "message-id": "<bab5fafb-6694-4582-b094-1a8c926b748b@apache.org>",
  "mid": "4soov8ojqxxfo1t1lxp4twgc2x6xldx0",
  "permalinks": [
    "4soov8ojqxxfo1t1lxp4twgc2x6xldx0",
    "r996baa9d8efe90b39c926ed6379f75829fe35412fe3ed2f1f7c49147@<announce.apache.org>"
  ],
  "dbid": "70ba6fb50ef5631f5e054218733f166bf1b4d7ff5ef4c9a4d91f58d3ca3576cb",
  "cc": "an...@tomcat.apache.org",
  "epoch": 1792502902,
  "list": "<announce.apache.org>",
  "list_raw": "<announce.apache.org>",
  "date": "2026/10/20 13:28:22",
  "private": false,
  "references": "",
  "in-reply-to": "",
  "body": "CVE-2026-80353 Apache Tomcat - TOCTOU when setting specific permissions \nfor Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR \nconnector\n\nSeverity: Low\n\nVendor: The Apache Software Foundation\n\nVersions Affected:\nApache Tomcat 9.0.47 to 9.0.122\n\nDescription:\nTime-of-check time-of-use (TOCTOU) race condition vulnerability in \nApache Tomcat when creating unix domain sockets for the APR/Native \nconnector allows an unauthorised local user to access the unix domain \nsocket. The fix for CVE-2026-65183 only addressed the NIO connector. It \ndid not address the same issue in the APR/Native connector.\n\nMitigation:\nUsers of the affected versions should apply one of the following\nmitigations:\n- Upgrade to Apache Tomcat 9.0.123\n\nCredit:\nThis issue was identified by:\n- h1ei1\n\nHistory:\n2026-10-20 Original advisory\n\nReferences:\n[1] https://tomcat.apache.org/security-9.html\n\n\n\n\n\n\n\n\n\n\n\n\n\n",
  "body_short": "CVE-2026-80353 Apache Tomcat - TOCTOU when setting specific permissions \nfor Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR \nconnector\n\nSeverity: Low\n\nVendor: The Apache Software Foun",
  "html_source_only": false,
  "attachments": [],
  "forum": "announce@apache.org",
  "size": 6841,
  "id": "4soov8ojqxxfo1t1lxp4twgc2x6xldx0"
}