{"id":"CVE-2026-103119","published":"2026-10-20T14:16:56.087","lastModified":"2026-10-20T19:35:38.940","description":"Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M25 through 11.0.26.\n\n\n\nUsers are recommended to upgrade to version 11.0.27, which fixes the issue.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","cwes":["CWE-127"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread.html/sk2cg4k077fwcqbm6tqz2n700nq06h80","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/28","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A buffer under-read in Apache Tomcat 11.0.0-M25 through 11.0.26 allows a large non-blocking write to cause response data leakage: the next request on the same connection may receive part of the prior response's body, risking exposure of sensitive data and request failures.","exploitability":"Exploitation requires an attacker to send a large non-blocking write request over a persistent HTTP/1.1 or HTTP/2 connection; no authentication or special privileges are needed, but success depends on timing and connection reuse.","blast_radius":"Successful exploitation could leak partial response bodies—including headers, cookies, or sensitive payloads—to subsequent requests on the same connection, potentially affecting all users sharing that backend connection pool or reverse proxy session.","remediation":"Upgrade Apache Tomcat to version 11.0.27 or later, which contains the official fix for this buffer under-read vulnerability.","detection":"Defenders may observe unexpected HTTP response truncation or misaligned request boundaries in access logs, especially when consecutive requests on the same connection show overlapping or shifted body content; no specific log field or signature is guaranteed, but anomalous Content-Length mismatches across sequential requests on the same connection are a potential indicator.","tags":["buffer-under-read","data-leakage","http","tomcat","connection-reuse"],"model":"garnet-coder","analyzedAt":"2026-10-25T08:49:57.649Z"}}