Apache Tomcat CVE-2026-80353

Requires Apache Tomcat 9.0.47-9.0.122 running with the APR/Native connector explicitly configured to use a unix domain socket (a non-default, specific deployment mode) - the NIO-connector variant was already fixed under CVE-2026-65183. The attacker must be a local, unprivileged user on the same host and must win a TOCTOU timing race during socket creation, accessing the socket before Tomcat applies correct permissions. Limiting factors: local host access is mandatory (no network/remote path), the vulnerable APR/Native + unix-domain-socket configuration must be in use, and success depends on a narrow, timing-sensitive race window.

No CVSS vector, EPSS score, KEV listing, or POC is provided for this CVE, so severity must be inferred from the description and CWE-367 (TOCTOU). The vulnerability is a local race condition - it requires an attacker to already have a local account on the host running Tomcat and to win a timing window during unix domain socket creation for the APR/Native connector. This is NOT a remote, network-reachable flaw, which sharply limits real-world risk compared to typical high-CVSS Tomcat CVEs. Exploitation status: no public exploit identified at time of analysis; not listed in CISA KEV. The practical priority is MODERATE-to-LOW for most deployments because it requires a non-default connector configuration (APR/Native with unix domain sockets), local access, and winning a narrow race - but it is a credible local information-disclosure/trust-boundary issue on multi-user hosts where those conditions hold. Notably this is an incomplete-fix follow-up: the earlier fix for CVE-2026-65183 only patched the NIO connector, so defenders who believed they were patched via that CVE may still be exposed on APR/Native. Authentication requirements cannot be confirmed from CVSS because no vector was supplied; the description states an 'unauthorised local user,' indicating low local privileges, but per analysis rules this is not CVSS-confirmed.

A low-privileged local user on a server running Apache Tomcat (9.0.47-9.0.122) with the APR/Native connector configured to use a unix domain socket races the socket-creation routine, accessing the socket in the window before correct filesystem permissions are applied. Having obtained access to the connector socket, the attacker can interact with or observe traffic that should have been restricted. No public exploit code is known, and exploitation depends on winning a timing-sensitive TOCTOU window.