Key points
- CVE-2026-103119 affects Apache Tomcat versions 11.0.0-M25 through 11.0.26.
- The vulnerability is rated Critical with a CVSS score of 9.1.
- Upgrading to version 11.0.27 resolves the buffer under-read issue.
This flaw could allow data from previous web requests to leak into subsequent ones, potentially exposing sensitive information. The source material indicates this occurs when a large non-blocking write splits a response body across requests on the same connection.
In plain English
The issue involves a buffer under-read vulnerability. According to the National Vulnerability Database, a large non-blocking write could result in the response body being split between the current request and the next request received on that connection. This may lead to the failure of the second request and possibly leakage of data from the first response to the second.
The background
The National Vulnerability Database classifies this weakness as CWE-127. The Apache Software Foundation confirmed the issue affects versions from 11.0.0-M25 up to 11.0.26. Mark Thomas, posting to the oss-security mailing list, described it as an AJP response mix-up. The severity is rated Critical with a CVSS score of 9.1.
What changes now
Users are advised to upgrade immediately to Apache Tomcat version 11.0.27. This update fixes the buffer under-read vulnerability that caused the potential data leakage. No other patches or workarounds have been confirmed by the vendor. Teams should verify their current version and apply the update to mitigate the risk.
The attacker's path
In intrusion scenarios, this technique serves the data exfiltration stage. Attackers typically exploit protocol handling errors to bypass application logic. By sending rapid, large requests, they can trigger buffer inconsistencies. Teams usually monitor for anomalous response sizes or mixed content types. Check whether your logging captures the full request-response cycle to detect such anomalies early.
What to do and how to stay safe: Apache Tomcat
- Identify all servers running Apache Tomcat versions 11.0.0-M25 through 11.0.26.
- Schedule an immediate upgrade to version 11.0.27 to apply the fix.
- Review access logs for unusual response patterns or data mixing errors.
- Monitor network traffic for unexpected data transfers on active connections.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Apache Tomcat are affected by CVE-2026-103119?
Versions 11.0.0-M25 through 11.0.26 are affected by this vulnerability.
What is the severity rating of this vulnerability?
It is rated Critical with a CVSS score of 9.1.
How can users fix this issue?
Users should upgrade to Apache Tomcat version 11.0.27.
