Vulnerability	Vulnerable Version
H Time-of-check Time-of-use (TOCTOU) Race Condition org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components. Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition due to a race condition in the setting of permissions for Unix domain sockets. An attacker can gain unauthorized access to the socket by exploiting the time gap between the permission check and the actual use. Note: This issue was fixed in Apache Tomcat 10.1.58 but the release vote for the 10.1.58 release candidate did not pass. Therefore, although users must download 10.1.59 to obtain a version that includes a fix for this issue, version 10.1.58 is not included in the list of affected versions. How to fix Time-of-check Time-of-use (TOCTOU) Race Condition? Upgrade `org.apache.tomcat:tomcat-util` to version 9.0.121, 10.1.59, 11.0.25 or higher.	[9.0.42,9.0.121)[10.1.0-M1,10.1.59)[11.0.0-M1,11.0.25)

Time-of-check Time-of-use (TOCTOU) Race Condition

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition due to a race condition in the setting of permissions for Unix domain sockets. An attacker can gain unauthorized access to the socket by exploiting the time gap between the permission check and the actual use.

Note: This issue was fixed in Apache Tomcat 10.1.58 but the release vote for the 10.1.58 release candidate did not pass. Therefore, although users must download 10.1.59 to obtain a version that includes a fix for this issue, version 10.1.58 is not included in the list of affected versions.

How to fix Time-of-check Time-of-use (TOCTOU) Race Condition?

Upgrade org.apache.tomcat:tomcat-util to version 9.0.121, 10.1.59, 11.0.25 or higher.

[9.0.42,9.0.121)[10.1.0-M1,10.1.59)[11.0.0-M1,11.0.25)

Go back to all versions of this package