CVE-2026-103119
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second
CVE-2026-103119: Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between…
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
CVE-2026-103119 at a glance
- CISA KEV
- Not listed (catalog checked )
- Highest advisory severity
- Critical
- CVSS base score
- 9.1 (Apache), 4.8 (Red Hat)
- Weakness
- CWE-125
- Fixed releases
- Apache: 11.0.27
- Red Hat: tomcat10-main-10.1.61-0.1.hum1, tomcat11-main-11.0.27-0.1.hum1, RHSA-2026:85926
- VulniPulse record
- Published · Updated
Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-103119; bulletin-wide values are not repeated here.
Is CVE-2026-103119 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2026-103119 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2026-103119?
Upgrade to a fixed release named by the vendor:
- Apache: 11.0.27
- Red Hat: tomcat10-main-10.1.61-0.1.hum1, tomcat11-main-11.0.27-0.1.hum1, RHSA-2026:85926
- Users are recommended to upgrade to version 11.0.27, which fixes the issue. (Apache)
Vendor advisory comparison
Apache
1 advisory- Advisory severityCritical9.1
Critical [CVE-2026-103119] Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second
CVE-2026-103119Source published Source updated
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second. This issue affects Apache Tomcat: from 11.0.0-M25 through 11.0.26. Users are recommended to upgrade to version 11.0.27, which fixes the issue.
- Affected products in this advisory
- Apache Tomcat
- Source-reported affected versions
- 11.0.0-M25 through 11.0.26.
- through 11.0.26
- Source-reported fixed versions
- 11.0.27
- Mitigation guidance
- Users are recommended to upgrade to version 11.0.27, which fixes the issue.
Red Hat
1 advisory- Advisory severityMedium4.8
Medium [CVE-2026-103119] Information disclosure via buffer under-read during non-blocking writes
CVE-2026-103119Source published Source updated
Information disclosure via buffer under-read during non-blocking writes. Red Hat rates this moderate (CVSS 4.8). Weakness: CWE-125. Red Hat lists fixing advisory RHSA-2026:85926 with package tomcat10-main-10.1.61-0.1.hum1, tomcat11-main-11.0.27-0.1.hum1. Affected product named by the advisory: Red Hat Hardened Images.
- Related products — impact not confirmed
- Red Hat Hardened Images
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- tomcat10-main-10.1.61-0.1.hum1
- tomcat11-main-11.0.27-0.1.hum1
- RHSA-2026:85926
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Browse the latest tracked CVEs or the CVEs listed in CISA KEV.
Android app · Google Play
Turn CVE research into alerts on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.