Search: CVE-2026-80353

A time-of-check time-of-use (TOCTOU) race condition vulnerability exists in Apache Tomcat's APR/Native connector when creating Unix domain sockets. This flaw allows an unauthorized local user to access the Unix domain socket. The issue affects Apache Tomcat versions from 9.0.47 through 9.0.122. The vulnerability was not addressed by the previous fix for CVE-2026-65183, which only covered the NIO connector. Users are advised to upgrade to version 9.0.123, where the issue is fixed.