Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example.
This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue.
Users are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-el-3.0-apiUpgrade tomcat-libUpgrade tomcat-webappsUpgrade tomcat-docs-webappUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-jsvcUpgrade tomcat | Oct 19, 2026 | Oct 19, 2026 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 9.0.121Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 10.1.59Upgrade Apache Tomcat to 11.0.25 | Aug 4, 2026 | Jul 28, 2026 |
| Debian | — | Upgrade tomcat9 | Jul 29, 2026 | Jul 29, 2026 |
| Redhat_linux | — | Upgrade jws6-tomcat-webappsUpgrade jws7-tomcat-servlet-6.0-apiNo solution existsUpgrade jws6-tomcat-docs-webappUpgrade jws7-tomcat-javadocUpgrade jws6-tomcatUpgrade jws7-tomcat-el-5.0-apiUpgrade jws6-tomcat-el-5.0-apiUpgrade jws6-tomcat-admin-webappsUpgrade jws6-tomcat-libUpgrade jws7-tomcatUpgrade jws7-tomcat-webappsUpgrade jws7-tomcat-admin-webappsUpgrade jws6-tomcat-selinuxUpgrade jws6-tomcat-servlet-6.0-apiUpgrade jws7-tomcat-libUpgrade jws6-tomcat-jsp-3.1-apiUpgrade jws7-tomcat-docs-webappUpgrade jws7-tomcat-jsp-3.1-apiUpgrade jws6-tomcat-javadocUpgrade jws7-tomcat-selinux | Aug 10, 2026 | Jul 28, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub