CVE-2026-66299: Apache Tomcat: DoS via WebSocket chat example
Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example.
This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue.
Users are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.25 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.58 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.121 - Remove
Remove
Apache Tomcat examples web applicationfrom your environment.Remove/uninstall the Tomcat examples web application because the vulnerability is in the WebSocket chat example.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66299?
CVE-2026-66299 has a risk rating of 26, indicating a significant severity level.
How do I fix CVE-2026-66299?
To fix CVE-2026-66299, remove the WebSocket chat example from your Apache Tomcat installation if it's still present.
Which versions of Apache Tomcat are affected by CVE-2026-66299?
CVE-2026-66299 affects Apache Tomcat versions 11.0.0-M20 through 11.0.24, 10.1.24 through 10.1.57, and 9.0.89 through 9.0.120.
What type of vulnerability is CVE-2026-66299?
CVE-2026-66299 is classified as an Uncontrolled Resource Consumption vulnerability.
What is the impact of CVE-2026-66299?
The impact of CVE-2026-66299 allows for Denial of Service (DoS) through the WebSocket chat example in Apache Tomcat.