Description

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.42 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-25T22:17:05.050Z",
  "pubdate": "2026-08-25T22:17:05.050Z",
  "executiveSummary": "This vulnerability is a Time-of-Check Time-of-Use (TOCTOU) race condition affecting the creation of Unix domain sockets in Apache Tomcat.\nThe flaw permits an unauthorized local attacker to manipulate the file system state during the socket creation process, potentially gaining access to the socket intended for legitimate service communication.\nAffected products include Apache Tomcat versions 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.42 through 9.0.120.\nThe risk is categorized as a local privilege escalation or information disclosure vector, as it allows a local user to intercept or hijack inter-process communication pathways.\nExploitation requires local access to the system where the Tomcat instance is running, as the attacker must interact with the file system path where the Unix domain socket is being instantiated.\nSuccessfully exploiting this condition compromises the integrity and confidentiality of the communication channel established by the affected Tomcat service.",
  "technicalDetails": "The vulnerability resides in the mechanism Apache Tomcat employs to initialize Unix domain sockets. A TOCTOU race condition occurs when there is a temporal gap between the time the application verifies the existence or permissions of a file system path and the time it subsequently performs an operation on that path.\nIn the context of Tomcat, the application checks for the availability of a specific file path for a Unix domain socket and then attempts to bind or create the socket file. An attacker operating on the same local system can monitor the directory for the initial check and, in the infinitesimal window before the actual creation, substitute a malicious link or pre-create a file with specific permissions.\nThe attack flow follows a precise sequence: 1) The Tomcat process initiates the socket creation sequence, checking if the target path is vacant or writable. 2) An attacker with local access initiates a race, attempting to create a symbolic link, a file, or modify directory attributes at the target path location immediately after the check but before the bind call executes. 3) Because the TOCTOU gap is not atomically protected, the application may inadvertently bind to an attacker-controlled or attacker-influenced file path.\nThis allows the attacker to intercept data streams intended for the Tomcat service or to impersonate the service to clients attempting to connect via the Unix domain socket. By positioning themselves as a 'man-in-the-middle' via the socket, the attacker can read sensitive requests or inject responses, effectively bypassing standard socket-level access controls.\nThe affected components are the internal Tomcat subsystems responsible for configuring and opening Unix domain socket endpoints. Since these sockets often handle administrative traffic or internal service proxies, the post-exploitation impact includes the potential for unauthorized data exfiltration or credential interception, depending on the nature of the services communicating over the socket.\nThe vulnerability is specific to local environments; remote attackers cannot trigger the race condition directly. However, in shared hosting environments or multi-user Linux systems, any low-privileged user capable of interacting with the target directory can potentially leverage this race condition to escalate their control over the service communication."
}