Apache Tomcat: Buffer under-read leads to response mix-up

Summary

Apache Tomcat 11.0.0-M25 through 11.0.26 contains a buffer under-read in the non-blocking write path. A large non-blocking write can split the response body between the current request and the next request on the same connection, most likely causing the second request to fail and possibly leaking data from the first response to the second. Exploitation requires an attacker who can send requests on a connection shared with a victim's response, and most sources describe the AJP connector as the affected path, while one report describes the HTTP/1.1 path, so both should be checked. Severity ratings differ (CNA 9.1, VulDB 6.3, Red Hat 4.8, Apache rates it Important).

Affected

• Apache Tomcat 11.0.0-M25 through 11.0.26
• Default configuration: unaffected (per CVE record)
• Other Tomcat branches: scope unclear in sources, check the advisory

Fixed in

• Apache Tomcat 11.0.27 (released 12 Oct 2026)
• Distribution packages: check your vendor advisory (openSUSE, Red Hat, Bitnami)

Workaround

• No vendor-documented workaround.
• If you cannot patch quickly: check whether the AJP connector is enabled and restrict it to trusted proxy hosts (own recommendation, not from a source).

Exploitation

• No public exploit known (VulDB).
• Not marked as known exploited by the sources reviewed.
• One OffSeq page mentions honeypot traffic; this wording is ambiguous and treated as unconfirmed.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.

Our recommendation

• Upgrade Apache Tomcat 11.x to 11.0.27 or later, prioritising internet-facing systems and systems with AJP enabled.
• Check Tomcat versions bundled in vendor packages and container images.
• If AJP is not needed, disable it; if it is needed, restrict it to trusted proxy hosts.
• Verify whether HTTP/1.1 exposure applies to your setup until Apache or NVD clarifies the scope.
• Rate priority high where Tomcat is internet-facing and medium where it is internal only.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Apache oss-security announcement (Openwall) www.openwall.com
• Apache Tomcat announcement thread lists.apache.org
• Apache Tomcat 11 security page tomcat.apache.org
• Apache Tomcat users mailing list announcement www.mail-archive.com
• Red Hat CVE record access.redhat.com
• VulDB entry vuldb.com
• Positive Technologies advisory (Vulners) vulners.com
• Secondary analysis (lilting.ch) lilting.ch

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:17.