CVE-2026-103119 Apache Tomcat - AJP response mix-up
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
Apache Tomcat 11.0.0-M25 to 11.0.26
Description:
A buffer under-read meant that a large non-blocking write could result
in the response body being split between the current request and the
next request received on that connection leading most likely to failure
of the second request and possibly leakage of data from the first
response to the second.
Mitigation:
Users of the affected versions should apply one of the following
mitigations:
- Upgrade to Apache Tomcat 11.0.27
Credit:
This issue was identified by:
- Tuomo Hänninen
History:
2026-10-20 Original advisory
References:
[1] https://tomcat.apache.org/security-11.html
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
