CVE-2026-103119Critical· 9.1▾ MidnightBuffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to fail…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the CISA ADP record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
— → 9.1
none → critical
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second.
This issue affects Apache Tomcat: from 11.0.0-M25 through 11.0.26.
Users are recommended to upgrade to version 11.0.27, which fixes the issue.
apache_tomcat >= 11.0.0-M25 <= 11.0.26Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-74049NoneApache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)
CVE-2026-74048NoneApache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up
CVE-2026-80353NoneApache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector
CVE-2026-88041NoneApache Tomcat: HTTP/2 trailer header cross-contamination
CVE-2026-101296NoneApache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms
CVE-2026-101356NoneApache Tomcat: HTTP/2 request/response mix-up after error during async processing