# CVE-2026-103119: Apache Tomcat buffer under-read in non-blocking writes

Source: https://junglewise.ai/threats/cve-2026-103119-buffer-under-read-vulnerability-in-apache-tomcat-meant-that-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-103119 · Severity: info · Published 2026-10-20

Apache Tomcat, a widely-used Java web application server, contains a buffer under-read flaw in its non-blocking I/O handling. When processing large writes on a single connection, response data from one request can leak into the next request on that connection, potentially exposing sensitive information or causing the second request to fail.

Technologies: [Apache Tomcat](https://junglewise.ai/threats/technologies/tomcat). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-103119 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103119 being exploited in the wild.

**How severe is CVE-2026-103119?** Informational severity, published 20 October 2026.

**Which products and versions are affected?** Apache Tomcat 11.0.0-M25 through 11.0.26.

**Is there a fix for CVE-2026-103119?** Yes: fixed in Tomcat 11.0.27. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-103119 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-103119?** Check whether you run Apache Tomcat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Tomcat 11.0.27

## Technical details

A buffer under-read vulnerability in Tomcat's non-blocking write logic causes response body data to be incorrectly split across multiple requests on the same connection. The flaw occurs when a large non-blocking write is processed, allowing response data from one request to bleed into the next request handled on that connection. This can result in data leakage from the first response or failure of subsequent requests.

## Affected products

- Apache Tomcat 11.0.0-M25 through 11.0.26

## Timeline

- 2026-10-20: disclosed

## References

- [https://lists.apache.org/thread.html/sk2cg4k077fwcqbm6tqz2n700nq06h80](https://lists.apache.org/thread.html/sk2cg4k077fwcqbm6tqz2n700nq06h80)

## Related threats

- [Apache Tomcat Jakarta Security credential handler bypass](https://junglewise.ai/threats/cve-2026-111248-the-jakarta-security-identity-store-backed-by-the-tomcat-user)
- [Apache Tomcat incomplete cleanup in TLS 1.3 connections](https://junglewise.ai/threats/cve-2026-93446-incomplete-cleanup-vulnerability-in-apache-tomcat-could-cause-tls)
- [Apache Tomcat HTTP trailer information leak between requests](https://junglewise.ai/threats/cve-2026-88041-incomplete-cleanup-vulnerability-in-apache-tomcat-allowed-an)
- [Apache Tomcat TOCTOU race condition in APR/Native connector](https://junglewise.ai/threats/cve-2026-80353-time-of-check-time-of-use-toctou-race-condition-vulnerability-in)
- [Apache Tomcat Execution After Redirect vulnerability](https://junglewise.ai/threats/cve-2026-74049-execution-after-redirect-ear-vulnerability-in-apache-tomcat-this)