Read the docs
TI-2026-46515 Aliases CVE-2026-65183GHSA-h3mr-2w3q-jcv9

Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets

Priority LOW 37CWE-367Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 9 fixed, 6 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.42 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00398 34th percentileScored 2026-11-07
Fix Partial Apache Tomcat (Apache Software Foundation): 8.5.0, 7.0.0Red Hat: 6 advisoriesRed Hat: 9 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Tomcat11.0.0-M1 – 11.0.24; 10.1.0-M1 – 10.1.57; 9.0.42 – 9.0.1208.5.0, 7.0.0Patch availableCNA
  • Apache Tomcat VendorApache Affected 11.0.0-M1 – 11.0.24; 10.1.0-M1 – 10.1.57; 9.0.42 – 9.0.120 Fixed in 8.5.0, 7.0.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*9.0.42 to before 9.0.121; 10.1.0 to before 10.1.58; 11.0.0 to before 11.0.25VulnerableApache
  • cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 9.0.42 to before 9.0.121; 10.1.0 to before 10.1.58; 11.0.0 to before 11.0.25 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Tomcat (Apache Software Foundation) Fixed in 8.5.0, 7.0.0

Red Hat 6 advisories

  • RHSA-2026:76952 Released 2026-10-07 · Red Hat rating Important
    Red Hat JBoss Web Server 7.0.2 release and security update
    • Red Hat JBoss Web Server 7.0 on RHEL 10 jws7-tomcat-11.0.21-7.redhat_00006.1.el10jws, jws7-tomcat-admin-webapps-11.0.21-7.redhat_00006.1.el10jws, jws7-tomcat-docs-webapp-11.0.21-7.redhat_00006.1.el10jws +7
    • Red Hat JBoss Web Server 7.0 on RHEL 8 jws7-tomcat-11.0.21-7.redhat_00006.1.el8jws, jws7-tomcat-admin-webapps-11.0.21-7.redhat_00006.1.el8jws, jws7-tomcat-docs-webapp-11.0.21-7.redhat_00006.1.el8jws +7
    • Red Hat JBoss Web Server 7.0 on RHEL 9 jws7-tomcat-11.0.21-7.redhat_00006.1.el9jws, jws7-tomcat-admin-webapps-11.0.21-7.redhat_00006.1.el9jws, jws7-tomcat-docs-webapp-11.0.21-7.redhat_00006.1.el9jws +7
  • RHSA-2026:76956 Released 2026-10-07 · Red Hat rating Important
    Red Hat JBoss Web Server 7.0.2 release and security update
    • Red Hat JBoss Web Server 7.0.2
  • RHSA-2026:73981 Released 2026-10-01 · Red Hat rating Important
    Red Hat JBoss Web Server 6.2.5 release and security update
    • Red Hat JBoss Web Server 6.2 on RHEL 10 jws6-tomcat-10.1.49-16.redhat_00016.1.el10jws, jws6-tomcat-admin-webapps-10.1.49-16.redhat_00016.1.el10jws, jws6-tomcat-docs-webapp-10.1.49-16.redhat_00016.1.el10jws +7
    • Red Hat JBoss Web Server 6.2 on RHEL 8 jws6-tomcat-10.1.49-16.redhat_00016.1.el8jws, jws6-tomcat-admin-webapps-10.1.49-16.redhat_00016.1.el8jws, jws6-tomcat-docs-webapp-10.1.49-16.redhat_00016.1.el8jws +7
    • Red Hat JBoss Web Server 6.2 on RHEL 9 jws6-tomcat-10.1.49-16.redhat_00016.1.el9jws, jws6-tomcat-admin-webapps-10.1.49-16.redhat_00016.1.el9jws, jws6-tomcat-docs-webapp-10.1.49-16.redhat_00016.1.el9jws +7
Show 3 more Red Hat advisories
  • RHSA-2026:73982 Released 2026-10-01 · Red Hat rating Important
    Red Hat JBoss Web Server 6.2.5 release and security update
    • Red Hat JBoss Web Server 6.2.5
  • RHSA-2026:63137 Released 2026-09-03 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images tomcat10-1:10.1.59-0.1.hum1@noarch@public-hummingbird-aarch64-rpms, tomcat10-1:10.1.59-0.1.hum1@noarch@public-hummingbird-x86_64-rpms, tomcat10-1:10.1.59-0.1.hum1@src +18
  • RHSA-2026:56039 Released 2026-08-18 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images tomcat11-1:11.0.25-0.1.hum1@noarch@public-hummingbird-aarch64-rpms, tomcat11-1:11.0.25-0.1.hum1@noarch@public-hummingbird-x86_64-rpms, tomcat11-1:11.0.25-0.1.hum1@src +18

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat JBoss Web Server 5AffectedNo fix planned: Out of support scope
Red Hat Hardened ImagesFixed RHSA-2026:56039, RHSA-2026:63137
Red Hat JBoss Web Server 6.2 on RHEL 10Fixed RHSA-2026:73981
Red Hat JBoss Web Server 6.2 on RHEL 8Fixed RHSA-2026:73981
Red Hat JBoss Web Server 6.2 on RHEL 9Fixed RHSA-2026:73981
Red Hat JBoss Web Server 6.2.5Fixed RHSA-2026:73982
Red Hat JBoss Web Server 7.0 on RHEL 10Fixed RHSA-2026:76952
Red Hat JBoss Web Server 7.0 on RHEL 8Fixed RHSA-2026:76952
Red Hat JBoss Web Server 7.0 on RHEL 9Fixed RHSA-2026:76952
Red Hat JBoss Web Server 7.0.2Fixed RHSA-2026:76956
Not affected: 1 product
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-65183
  2. 2026-10-03 Alias added: GHSA-h3mr-2w3q-jcv9
  3. 2026-10-07 Fix available: RHSA-2026:76952 · Red Hat
  4. 2026-10-07 Fix available: Red Hat JBoss Web Server 7.0 on RHEL 10, Red Hat JBoss Web Server 7.0 on RHEL 8, Red Hat JBoss Web Server 7.0 on RHEL 9 · Red Hat
  5. 2026-10-09 Fix available: RHSA-2026:76956 · Red Hat
  6. 2026-10-16 Fix available: Red Hat JBoss Web Server 7.0.2 · Red Hat

References

Advisory 2

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
See all 273 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences