Linux Distros Unpatched Vulnerability : CVE-2026-80353

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Time-of-check time-of-use TOCTOU race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an...

SUSE CVE-2026-80353

Time-of-check time-of-use TOCTOU race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the sam...

DEBIAN-CVE-2026-80353

Time-of-check time-of-use TOCTOU race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the sam...

CVE-2026-80353

A flaw was found in Apache Tomcat. A local attacker can gain unauthorized access to Unix domain communication sockets due to a time-of-check to time-of-use TOCTOU race condition in the APR/Native connector. When the connector initializes a socket, a brief timing window exists before restrictive...

CLSA-2026-1792519677 apr-util: Fix of 2 CVEs

CVE-2026-32327: apr-util: stack recursion crash parsing deeply nested XML in aprxmlquoteelem - CVE-2026-34502: apr-util: heap buffer overflow in the APR memcached client...

CVE-2026-80353

Time-of-check time-of-use TOCTOU race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the sam...

CVE-2026-80353 Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector

Time-of-check time-of-use TOCTOU race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the sam...

EUVD-2026-105006

Time-of-check time-of-use TOCTOU race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the sam...

CVE-2026-80353

Time-of-check time-of-use TOCTOU race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the sam...

CVE-2026-80353

Apache Tomcat versions 9.0.47 through 9.0.122 are vulnerable to a Time-of-check time-of-use (TOCTOU) race condition (CWE-367) during the creation of Unix domain sockets for the APR/Native connector . This flaw allows an unauthorised local user to access the Unix domain socket. The issue persists ...

tomcat: tomcat: Unauthorized socket access via TOCTOU race condition

A flaw was found in Apache Tomcat. A local attacker can gain unauthorized access to Unix domain communication sockets due to a time-of-check to time-of-use TOCTOU race condition in the APR/Native connector. When the connector initializes a socket, a brief timing window exists before restrictive...

PT-2026-118381

Time-of-check time-of-use TOCTOU race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the sam...

Astra Linux – Vulnerability in Tomcat9

There is a vulnerability in Apache Tomcat when using the APR/Native connector, involving concurrent execution with shared resources and improper synchronization known as “race condition”. This issue is particularly noticeable during client-initiated closures of HTTP/2 connections. This issue...

tomcat: tomcat: Unauthorized socket access via TOCTOU race condition

A flaw was found in Apache Tomcat. A local attacker can gain unauthorized access to Unix domain communication sockets due to a time-of-check to time-of-use TOCTOU race condition in the APR/Native connector. When the connector initializes a socket, a brief timing window exists before restrictive...

EulerOS 2.0 SP11 : apr-util (EulerOS-SA-2026-4302)

According to the versions of the apr-util packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility:...

EulerOS 2.0 SP11 : apr-util (EulerOS-SA-2026-4211)

According to the versions of the apr-util packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility:...

EulerOS 2.0 SP13 : apr-util (EulerOS-SA-2026-4120)

According to the versions of the apr-util packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons,...

Malicious code in staking-apr-fetcher (RubyGems)

Source: amazon-inspector 405ab5b9651b8e8817ae91290042ec22673c5c99c1b58f45747e47cbb85aeacf The gem declares a native extension whose build script extconf.rb decodes a base64-embedded Ruby payload and executes it via eval during gem install. The payload double-forks a detached background process th...

MAL-2026-17796 Malicious code in staking-apr-fetcher (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 405ab5b9651b8e8817ae91290042ec22673c5c99c1b58f45747e47cbb85aeacf The gem declares a native extension whose build script extconf.rb decodes a base64-embedded Ruby payload and executes it via eval during gem install...

Malicious code in staking-apr-fetcher (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 405ab5b9651b8e8817ae91290042ec22673c5c99c1b58f45747e47cbb85aeacf The gem declares a native extension whose build script extconf.rb decodes a base64-embedded Ruby payload and executes it via eval during gem install...