CVE-2026-103119

Summary

A buffer under-read in Apache Tomcat 11.0.0-M25 through 11.0.26 allows a large non-blocking write to cause response data leakage: the next request on the same connection may receive part of the prior response's body, risking exposure of sensitive data and request failures.

Exploitability

Exploitation requires an attacker to send a large non-blocking write request over a persistent HTTP/1.1 or HTTP/2 connection; no authentication or special privileges are needed, but success depends on timing and connection reuse.

Blast radius

Successful exploitation could leak partial response bodies—including headers, cookies, or sensitive payloads—to subsequent requests on the same connection, potentially affecting all users sharing that backend connection pool or reverse proxy session.

Detection

Defenders may observe unexpected HTTP response truncation or misaligned request boundaries in access logs, especially when consecutive requests on the same connection show overlapping or shifted body content; no specific log field or signature is guaranteed, but anomalous Content-Length mismatches across sequential requests on the same connection are a potential indicator.

Prioritized remediation

Upgrade Apache Tomcat to version 11.0.27 or later, which contains the official fix for this buffer under-read vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.