Download Apache Tomcat 11.0.27 Now to Prevent Cross-Request Data Leaks in AJP Protocol

Apache Tomcat users must upgrade to version 11.0.27 to address a critical security flaw that allows response data to leak between web requests. The vulnerability affects versions 11.0.0-M25 through 11.0.26 and stems from a buffer under-read error in Apache Tomcat.

The issue arises when a large non-blocking write operation splits a response body across two separate requests on the same connection. This split can cause the second request to fail and may possibly leak data from the first response into the second, according to the source material.

Context and Background

The National Vulnerability Database rates CVE-2026-103119 as critical with a CVSS score of 9.1. Mark Thomas posted the advisory on October 20 via the oss-security mailing list, describing it as an important security update for the Apache Software Foundation’s web server software.

The flaw is classified under CWE-127, indicating a buffer under-read weakness. This type of error occurs when software reads data from a memory buffer beyond its intended boundaries, potentially exposing residual data from previous operations to new requests.

Who Is Affected

Any organization running Apache Tomcat versions 11.0.0-M25 through 11.0.26 is vulnerable to this data leakage risk. The Apache Software Foundation recommends immediate upgrades to version 11.0.27, which resolves the buffer under-read issue and prevents response mixing on persistent connections.

Small-business owners relying on Apache Tomcat for web applications should verify their current version and apply the patch. Failure to update leaves systems exposed to potential data leaks, especially under high-traffic conditions where non-blocking writes are common.

What to watch

Monitor Apache Tomcat release notes for future security updates. Check server logs for unusual request failures that may indicate response splitting. Ensure all instances of Tomcat 11 are updated to 11.0.27 or later to mitigate this specific vulnerability.

What made it possible

Buffer under-read vulnerabilities typically exploit how applications manage memory during data transmission. When a system reads beyond allocated buffer limits, it may expose leftover data from prior operations. This weakness often serves as an initial foothold in intrusion attempts, allowing attackers to harvest sensitive information without direct exploitation of application logic. Teams usually assess memory handling practices to prevent such leaks.

What to do and how to stay safe: Apache Tomcat

• Verify your Apache Tomcat version and upgrade to 11.0.27 if you are running 11.0.0-M25 through 11.0.26.
• Review server logs for signs of request failures or unexpected data mixing on persistent connections.
• Implement monitoring for anomalous traffic patterns that could indicate exploitation of this vulnerability.
• Once the vendor provides an update, test it in a staging environment before deploying to production servers.

Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-103119?

It is a critical buffer under-read vulnerability in Apache Tomcat 11 that can cause data leakage between requests on the same connection.

Which versions of Apache Tomcat are affected?

Versions 11.0.0-M25 through 11.0.26 are affected by this vulnerability.

How can I fix this issue?

Upgrade to Apache Tomcat version 11.0.27, which includes the fix for this buffer under-read flaw.