CVE-2026-103119
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result…
- Risk score
- 69/100
- CVSS
- 9.1 v3.1
- Exploit chance (30 days)
- 0.6%
- Published
- 20 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A buffer under-read vulnerability in Apache Tomcat allows an attacker to split the response body between requests, leading to potential failure of subsequent requests and data leakage. This could result in high impact to confidentiality.
- Affected
- {'products': ['Apache Tomcat'], 'packages': [], 'versions': ['11.0.0-M25', '11.0.26']}
- Fix
- Upgrade to version 11.0.27
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.1 critical
- Remotely exploitable without logging in
References
Original description
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second. This issue affects Apache Tomcat: from 11.0.0-M25 through 11.0.26. Users are recommended to upgrade to version 11.0.27, which fixes the issue.
Last activity 20 Oct 2026. Patch Forecast updates every hour.