Apache Tomcat 11.0.27 Fixes Critical Cross-Request Data Leak in Versions 11.0.0-M25 Through 11.0.26

Apache Tomcat 11 contains a buffer under-read vulnerability that can cause data leakage between HTTP requests. Security teams managing versions 11.0.0-M25 through 11.0.26 must upgrade to 11.0.27 to stop potential information disclosure.

What happened

Apache Software Foundation identified a buffer under-read vulnerability in Apache Tomcat, designated CVE-2026-103119. The National Vulnerability Database rates this flaw as Critical with a CVSS score of 9.1. The issue involves a large non-blocking write that could result in the response body being split.

According to the official advisory posted by Mark Thomas on October 20, the vulnerability occurs when a response body is split. This split happens between the current request and the next request received on the same connection. The result is typically a failure of the second request.

However, the more severe outcome is the possible leakage of data from the first response into the second. This means sensitive information from one user's session could theoretically appear in another user's response. The flaw is present in the specified versions of the software.

Why it matters

This vulnerability affects all Apache Tomcat installations running versions 11.0.0-M25 through 11.0.26. Organizations using these versions are exposed to the risk. The risk is not just service disruption but potential data exfiltration.

A critical CVSS score indicates that the impact is high. Security operations teams must treat this as an urgent remediation task. The flaw allows data from one transaction to bleed into the next.

This type of data mix-up can expose sensitive application data to unauthorized parties. The vulnerability exists for any deployment that has not yet upgraded. The window of exposure remains open until the patch is applied.

Our take on the response

• Upgrade all affected Apache Tomcat 11 instances to version 11.0.27 immediately.
• Verify that no older versions remain in staging or development environments.
• Review server configurations to ensure they are not exposed to untrusted networks.
• Monitor server logs for unusual request patterns or response failures following the update.

What defenders should look for

Teams usually see signs of this activity in web server access logs. Look for large response sizes followed immediately by small or failed requests on the same connection. Check for unexpected data in responses that do not match the requested resource. Review server logs for anomalies in request handling. Containment involves isolating affected servers and blocking external access until patched. Monitor for data exfiltration patterns in network traffic.

Background: Data exfiltration

Data exfiltration is the unauthorized transfer of information from a computer or network to an external recipient. It occurs when attackers move sensitive files, credentials, or databases out of your control. Understanding the methods helps you spot the subtle signs of data leaving your environment without triggering standard alarms.

Read the full guide: Data Exfiltration Explained: How Data Leaves Your Network

What to do and how to stay safe: Apache Tomcat

• Inventory all Apache Tomcat 11 servers and check their current version numbers against the affected range.
• Schedule immediate upgrades to version 11.0.27 for any server running 11.0.0-M25 through 11.0.26.
• Restrict access to server ports to trusted internal networks only, reducing the attack surface.
• Monitor server logs for request failures or unusual data patterns that might indicate exploitation attempts.

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Apache Tomcat versions are vulnerable to CVE-2026-103119?

Versions from 11.0.0-M25 through 11.0.26 are affected by this buffer under-read vulnerability.

What is the CVSS score for CVE-2026-103119?

The National Vulnerability Database rates CVE-2026-103119 as Critical with a CVSS score of 9.1.

How can organizations fix this vulnerability?

Users are recommended to upgrade to Apache Tomcat version 11.0.27, which fixes the issue.