Orgs Using Apache Tomcat 11 Must Upgrade to 11.0.27 to Stop Data Leaks From Buffer Under-Read Flaw

Apache Tomcat versions 11.0.0-M25 through 11.0.26 are affected by a critical security flaw identified as CVE-2026-103119. The National Vulnerability Database rates this issue with a CVSS score of 9.1. The vulnerability involves a buffer under-read weakness, classified as CWE-127. Users of these specific versions must upgrade to version 11.0.27 to eliminate the risk, as confirmed by the vendor.

How it unfolded

• Mark Thomas posted an advisory on the oss-security mailing list on October 20 regarding the AJP response mix-up.
• The advisory described the buffer under-read vulnerability in Apache Tomcat that causes response body splitting.
• The Apache Software Foundation released version 11.0.27 to fix the issue in affected Tomcat installations.

Who is affected

Only Apache Tomcat installations running versions from 11.0.0-M25 up to and including 11.0.26 are vulnerable. The flaw occurs during large non-blocking writes. This technical issue causes the response body to split between the current request and the subsequent request on the same connection. Consequently, the second request likely fails. More importantly, data from the first response may leak into the second request, creating a confidentiality risk for organizations handling sensitive information.

Our take on the response

The vendor has provided a clear remediation path by releasing version 11.0.27. The advisory explicitly states that this update fixes the issue. Given the critical severity rating from the NVD, the availability of a patch allows for immediate remediation. There is no indication that a workaround other than upgrading is recommended by the vendor. Teams should prioritize updating all instances within the affected version range to prevent potential data leakage and request failures.

Who needs to act first

Managed service providers should prioritize systems exposed to the internet or handling sensitive client data. Teams usually begin by identifying all servers running the vulnerable Tomcat versions. Check whether any instances are in production before testing the upgrade in a staging environment. Back up configurations and data before applying the patch. Roll out the fix to a small subset of servers first to verify stability. Monitor logs for any unexpected errors after the update. This approach minimizes disruption while ensuring critical assets are protected promptly.

What to do and how to stay safe: Apache Tomcat

• Verify the current version of Apache Tomcat on all managed servers to determine if they fall within the affected range.
• Download and test version 11.0.27 in a non-production environment to ensure compatibility with existing applications.
• Schedule the upgrade for production systems during a maintenance window to reduce the risk of service interruption.
• Monitor server logs after the update to confirm that the vulnerability has been resolved and no new issues have emerged.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-103119?

The National Vulnerability Database rates this vulnerability as critical with a CVSS score of 9.1.

Which Apache Tomcat versions are affected by this buffer under-read flaw?

Versions from 11.0.0-M25 through 11.0.26 are affected by this vulnerability.

Is there a patch available to fix this issue?

Yes, users are recommended to upgrade to version 11.0.27, which fixes the issue.