Apache Tomcat: Buffer under-read vulnerability (CVE-2026-103119)

Apache Tomcat versions 11.0.0-M25 through 11.0.26 contain a buffer under-read vulnerability identified as CVE-2026-103119. This flaw is triggered during large non-blocking write operations. When an application performs a large write, the internal buffer management logic can fail, causing the response body to be incorrectly segmented. Consequently, a portion of the response body from a current request may be unintentionally appended to the subsequent request handled over the same persistent HTTP connection. This behavior can lead to denial-of-service conditions through request failures or, more critically, the unauthorized disclosure of response data to the user of the following request. Given the potential for cross-user data leakage, organizations utilizing these versions of Apache Tomcat in multi-tenant or sensitive environments should prioritize remediation.

Impact

Successful exploitation can lead to a loss of data confidentiality, where sensitive information from one user's request is leaked to the subsequent request on the same connection. Furthermore, the mismatch in expected data streams often results in request processing failures, which can be leveraged to cause service instability.

Recommendation

• Upgrade all instances of Apache Tomcat to version 11.0.27 or later to address the root cause of the buffer under-read.
• Review web server access logs for anomalous behavior, such as high frequencies of malformed request errors or internal server errors (500 status) occurring in persistent connection pools, which may indicate attempted exploitation or accidental triggering of this state.
• Prioritize patching for internet-facing systems that utilize persistent connections (keep-alive) for high-volume traffic.