tomcat: Apache Tomcat: Local information disclosure via Unix domain socket TOCTOU race condition

🗓️ 03 Sep 2026 09:43:07Reported by RedHatType

redhat🔗 access.redhat.com👁 11 Views

TOCTOU race in Apache Tomcat Unix domain socket creation enabling local information disclosure.

Reporter	Title	Published	Views	Family All 66
IBM Security Bulletins	Security Bulletin: IBM ApplinX is vulnerable to multiple issues like improper Access control, Authentication Bypass, Improper Authorization and more due to the use of Apache-Tomcat .	22 Sep 202612:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway for Multiplatforms.	9 Sep 202609:46	–	ibm
IBM Security Bulletins	Security Bulletin: DEV-EXT - tomcat-embed-core-10.1.57.jar (Publicly disclosed vulnerability found by Scanner)	17 Sep 202620:18	–	ibm
AstraLinux	Astra Linux – Vulnerability in Tomcat9	14 Sep 202612:41	–	astralinux
Circl	CVE-2026-65183	26 Aug 202600:48	–	circl
CVE	CVE-2026-65183	25 Aug 202621:44	–	cve
Cvelist	CVE-2026-65183 Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets	25 Aug 202621:44	–	cvelist
Debian CVE	CVE-2026-65183	25 Aug 202621:44	–	debiancve
EUVD	EUVD-2026-66125	26 Aug 202600:30	–	euvd
F5 Networks	K000163240: Multiple Apache Tomcat vulnerabilities	8 Sep 202607:23	–	f5

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Hardened Images	any	noarch	tomcat10	10.1.59-0.1.hum1	tomcat10-10.1.59-0.1.hum1.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-65183
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
lists	www.lists.apache.org/thread/748o4st6d5dk6n3l7tgzo5yl68gg05c0
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-65183
cve	www.cve.org/CVERecord

15 Sep 2026 16:12Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.18.1

EPSS0.00456

SSVC

Apache Tomcat TOCTOU race Unix domain socket information disclosure local access