Apache Tomcat EUVD-2026-105012

Exploitation requires the affected Tomcat deploying an application that performs large non-blocking (NIO) writes, combined with HTTP connection reuse (keep-alive) so that a subsequent request is received on the same connection while the oversized write is in progress; only then can the response body be split across requests. Limiting factors: the outcome is non-deterministic (the advisory states the second request will 'most likely' fail and data leakage is only 'possibly' achievable), so an attacker cannot reliably control which or how much first-response data leaks; applications that do not use large non-blocking writes are not meaningfully exposed. Affected only in 11.0.0-M25 through 11.0.26; upgrading to 11.0.27 removes the condition.

The input provides a CVSS 3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H (9.1 Critical), indicating a remote, unauthenticated, network-reachable flaw with high confidentiality and availability impact. No EPSS score, no KEV listing, and no POC were provided, so exploitation signals rely entirely on the vendor advisory. The description's own hedging language ('most likely' failure of the second request, 'possibly' leakage of data) argues the real-world attack complexity is higher than the AC:L in the supplied vector suggests: triggering the response-body split requires a specific runtime condition (a large non-blocking write) plus connection reuse so that a second request lands on the same connection - this is closer to a non-deterministic race than a clean, repeatable network exploit. The confidentiality impact is also probabilistic (cross-response data leakage is possible, not guaranteed), so the practical exploitability is lower than the headline 9.1 implies. Net assessment: a genuine, patch-worthy issue in a ubiquitous server, but given no evidence of active exploitation or public exploit code and the condition-dependent trigger, this is a prompt-patch priority rather than an emergency 'drop everything' zero-day. Note the discrepancy: vendor-rated AC:L versus a description that describes condition-dependent, probabilistic behavior - this analysis assesses AC:H (see assessed vector).

An attacker sends sequential HTTP requests over a keep-alive connection to a Tomcat instance whose application performs large non-blocking writes; the buffer under-read causes part of one user's response body to spill into the handling of the next request on that connection, corrupting the second request and potentially leaking bytes of the first response to a different request. No public exploit code was identified, and reliable exploitation depends on timing and the application's non-blocking write pattern rather than a deterministic single-shot request.