Apache Tomcat fixes a critical flaw that can mix up responses between requests and leak data

What happened

CVE-2026-103119, published today, 20 October 2026, is a buffer under-read vulnerability in Apache Tomcat, the widely used Java application server. According to the description in NVD, when the server performs a large non-blocking write, the response body can end up split between the current request and the next request received on the same connection.

The most likely outcome is that the second request fails. However, data from the first response may also leak into the second, meaning information intended for one request could be delivered in response to another.

The flaw carries a CVSS score of 9.1 (critical). Its vector shows it can be exploited over the network, without authentication and without user interaction, with high impact on confidentiality and availability, though not on data integrity.

Who is affected

According to the published data, the issue affects Apache Tomcat installations in the 11.0 branch within the range below. The available information only mentions this branch; it has not been stated whether other Tomcat branches are affected.

Bear in mind that Tomcat is not only deployed as a standalone server: many applications and third-party products ship with an embedded copy, so it may be running on systems where it does not appear as such in the asset inventory.

• Affected: Apache Tomcat 11.0.0-M25 through 11.0.26, inclusive.
• Fixed: Apache Tomcat 11.0.27.

Exploitation status

There is currently no evidence of active exploitation: CVE-2026-103119 is not listed in CISA's KEV catalog. Even so, the critical score and the fact that no credentials or user interaction are required make it advisable not to delay the upgrade, especially on internet-facing servers.

What to do

The official recommendation is to upgrade to version 11.0.27, which fixes the issue. The published information does not describe any workarounds, so patching is the main course of action.

• Inventory servers running Apache Tomcat 11.0 and check which version they use.
• Upgrade any installation between 11.0.0-M25 and 11.0.26 to Apache Tomcat 11.0.27.
• Prioritise servers reachable from the internet or serving large numbers of users.
• Review applications and third-party products that embed Tomcat and check with their vendors whether updated versions are available.
• Until the upgrade is complete, watch server logs for unusual response errors or requests failing without an obvious cause.

Affected technologies

Vulnerabilities (1)