{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/tomcat-9.0.118-9.0.122/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-103119"},{"id":"CVE-2026-101356"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Tomcat (11.0.0-M25 through 11.0.26)","Tomcat (11.0.22-11.0.26)","Tomcat (10.1.55-10.1.60)","Tomcat (9.0.118-9.0.122)"],"_cs_severities":["critical"],"_cs_tags":["web-application","vulnerability","http2"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Tomcat versions 11.0.0-M25 through 11.0.26 contain a buffer under-read vulnerability identified as CVE-2026-103119. This flaw is triggered during large non-blocking write operations. When an application performs a large write, the internal buffer management logic can fail, causing the response body to be incorrectly segmented. Consequently, a portion of the response body from a current request may be unintentionally appended to the subsequent request handled over the same persistent HTTP connection. This behavior can lead to denial-of-service conditions through request failures or, more critically, the unauthorized disclosure of response data to the user of the following request. Given the potential for cross-user data leakage, organizations utilizing these versions of Apache Tomcat in multi-tenant or sensitive environments should prioritize remediation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation can lead to a loss of data confidentiality, where sensitive information from one user's request is leaked to the subsequent request on the same connection. Furthermore, the mismatch in expected data streams often results in request processing failures, which can be leveraged to cause service instability.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of Apache Tomcat to version 11.0.27 or later to address the root cause of the buffer under-read.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous behavior, such as high frequencies of malformed request errors or internal server errors (500 status) occurring in persistent connection pools, which may indicate attempted exploitation or accidental triggering of this state.\u003c/li\u003e\n\u003cli\u003ePrioritize patching for internet-facing systems that utilize persistent connections (keep-alive) for high-volume traffic.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T19:45:18Z","date_published":"2026-10-20T16:36:15Z","id":"https://feed.craftedsignal.io/briefs/2026-10-apache-tomcat-buffer-under-read/","summary":"A buffer under-read vulnerability in Apache Tomcat versions 11.0.0-M25 through 11.0.26 allows for sensitive data leakage or request failure by incorrectly mixing response bodies between consecutive requests on the same connection.","title":"Apache Tomcat: Buffer under-read vulnerability (CVE-2026-103119)","url":"https://feed.craftedsignal.io/briefs/2026-10-apache-tomcat-buffer-under-read/"}],"language":"en","title":"CraftedSignal Threat Feed - Tomcat (9.0.118-9.0.122)","version":"https://jsonfeed.org/version/1.1"}