Cyber ·
CVE-2026-103119: Apache Tomcat AJP response mixing between requests
Important-severity advisory on an insufficient buffer read flaw in Apache Tomcat that can mix responses across requests on the same connection and possibly expose data. Affected versions 11.0.0-M25 through 11.0.26.
On 20 October 2026, the Apache Tomcat maintainer published advisory CVE-2026-103119 on the oss-sec feed, rated important. According to the machine-translated text, an insufficient buffer read flaw means that during a large non-blocking write, the body of one response can be split between the current request and the next request received on the same connection. The probable result is failure of the second request and, possibly, leakage of data from the first response to the second. Affected versions run from 11.0.0-M25 through 11.0.26. The source text is truncated, so exact exploitation conditions and the indicated fix must be read in the original advisory.
To verify, consult the original advisory on the oss-sec feed of the security mailing list, search the identifier CVE-2026-103119 in official vulnerability databases, and check the Tomcat version installed on your servers. Rota Nacional is not an application server and does not patch this software; this entry is informational only.
Original source: CVE-2026-103119: Apache Tomcat — confusão de resposta AJP