CVE-2026-65183: Apache Tomcat TOCTOU Race Condition

CVE-2026-65183 Overview

CVE-2026-65183 is a Time-of-check Time-of-use (TOCTOU) race condition in Apache Tomcat's Unix domain socket creation logic. The flaw lets an unauthorized local user access the Unix domain socket during a narrow window between the permission check and the socket's use. Affected versions include Apache Tomcat 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.42 through 9.0.120. The Apache Tomcat project has released fixed versions 11.0.25, 10.1.58, and 9.0.121. The weakness is classified as [CWE-367].

Critical Impact
A local unauthorized user can win the race and gain access to a Unix domain socket that Tomcat exposes, undermining the confidentiality, integrity, and availability of connections carried over that socket.

Affected Products

Apache Tomcat 11.0.0-M1 through 11.0.24
Apache Tomcat 10.1.0-M1 through 10.1.57
Apache Tomcat 9.0.42 through 9.0.120

Discovery Timeline

2026-08-25 - CVE-2026-65183 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-65183

Vulnerability Analysis

Apache Tomcat can bind connectors to Unix domain sockets (UDS) as an alternative to TCP endpoints. When Tomcat creates the socket file on disk, it performs a check on the filesystem state and then acts on that state to establish permissions and ownership. Between the check and the use, an attacker with local filesystem access can manipulate the target path. The manipulation causes Tomcat to operate on an attacker-controlled object rather than the intended socket file.

The outcome is that a local user who should not have access to the socket can interact with it. Because the socket typically carries HTTP/AJP traffic between a fronting server and Tomcat, unauthorized access allows request injection, response tampering, and disruption of application traffic.

Root Cause

The root cause is a non-atomic sequence of filesystem operations during Unix domain socket creation. Tomcat validates or prepares the socket path in one step and then binds or adjusts permissions in a later step. This TOCTOU gap violates the atomicity required when placing privileged resources on a shared filesystem, and it maps directly to [CWE-367].

Attack Vector

The attacker must have local access to the host running Tomcat and the ability to write to the directory that holds the Unix domain socket. During Tomcat startup or socket recreation, the attacker races the creation sequence with symlink swaps or file replacements. On success, the attacker either reads and writes the resulting socket or substitutes an attacker-controlled endpoint. See the Apache Mailing List Discussion and the OpenWall OSS-Security Update for details.

No public proof-of-concept exploit is currently available for CVE-2026-65183.

Detection Methods for CVE-2026-65183

Indicators of Compromise

Unix domain socket files owned or accessible by unexpected local users in the directory configured for the Tomcat UDS connector.
Symbolic links or newly created files appearing in the socket directory shortly before or during Tomcat startup.
Unexpected processes with open file descriptors to the Tomcat UDS path, visible via lsof or ss -xl.

Detection Strategies

Audit filesystem events on the directory containing the Unix domain socket using auditd or fanotify, focusing on create, symlink, rename, and chmod operations by non-Tomcat UIDs.
Compare the running Apache Tomcat version against fixed versions 11.0.25, 10.1.58, and 9.0.121 across the estate.
Review Tomcat startup logs for socket bind errors or permission anomalies that may indicate an interrupted race.

Monitoring Recommendations

Alert on any local user other than the Tomcat service account writing to the UDS parent directory.
Track socket file permissions after Tomcat startup and flag deviations from the expected mode and owner.
Correlate local process telemetry with Tomcat restarts to surface race-condition attempts against the socket path.

How to Mitigate CVE-2026-65183

Immediate Actions Required

Upgrade Apache Tomcat to 11.0.25, 10.1.58, or 9.0.121 depending on the deployed major version.
Restrict the parent directory of the Unix domain socket to the Tomcat service account with mode 0700 and disallow writes by any other local user.
Restart Tomcat after the upgrade and verify that the socket file is owned by the expected user and group.

Patch Information

The Apache Tomcat project fixed CVE-2026-65183 in versions 11.0.25, 10.1.58, and 9.0.121. Refer to the Apache Mailing List Discussion and the OpenWall OSS-Security Update for the vendor announcement and additional context.

Workarounds

Place the Unix domain socket in a directory that only the Tomcat service account can access, eliminating the local attacker's ability to win the race.
Where feasible, temporarily switch the connector from a Unix domain socket to a loopback TCP endpoint bound to 127.0.0.1 until the patched version is deployed.
Reduce the number of local user accounts on Tomcat hosts and enforce least-privilege access to application directories.

bash

# Configuration example: restrict the Unix domain socket parent directory
sudo install -d -o tomcat -g tomcat -m 0700 /var/run/tomcat
# Verify ownership and mode after Tomcat starts
ls -ld /var/run/tomcat
stat -c '%U %G %a %n' /var/run/tomcat/tomcat.sock