[SECURITY] CVE-2026-103119 Apache Tomcat - AJP response mix-up

[Mark Thomas <ma...@apache.org>]

CVE-2026-103119 Apache Tomcat - AJP response mix-up

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:
Apache Tomcat 11.0.0-M25 to 11.0.26

Description:
A buffer under-read meant that a large non-blocking write could result 
in the response body being split between the current request and the 
next request received on that connection leading most likely to failure 
of the second request and possibly leakage of data from the first 
response to the second.

Mitigation:
Users of the affected versions should apply one of the following
mitigations:
- Upgrade to Apache Tomcat 11.0.27

Credit:
This issue was identified by:
- Tuomo Hänninen

History:
2026-10-20 Original advisory

References:
[1] https://tomcat.apache.org/security-11.html


















---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org