Quick answers
- Is CVE-2026-103119 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-103119 being exploited in the wild.
- How severe is CVE-2026-103119?
- Informational severity, published 20 October 2026.
- Which products and versions are affected?
- Apache Tomcat 11.0.0-M25 through 11.0.26.
- Is there a fix for CVE-2026-103119?
- Yes: fixed in Tomcat 11.0.27. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-103119 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-103119?
- Check whether you run Apache Tomcat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Tomcat 11.0.27
Technical details
A buffer under-read vulnerability in Tomcat's non-blocking write logic causes response body data to be incorrectly split across multiple requests on the same connection. The flaw occurs when a large non-blocking write is processed, allowing response data from one request to bleed into the next request handled on that connection. This can result in data leakage from the first response or failure of subsequent requests.
Affected products
- Apache Tomcat 11.0.0-M25 through 11.0.26
Timeline
- 2026-10-20: disclosed