CVE-2026-77791: Apache Tomcat: DoS via busy wait during WebSocket close
Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack.
This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121.
The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.88 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.26 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.60 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.122
Event History
Frequently Asked Questions
Which Tomcat versions need remediation?
Affected supported release lines are 11.0.0-M5 through 11.0.25, 10.1.8 through 10.1.59, and 9.0.74 through 9.0.121. Upgrade to 11.0.26, 10.1.60, or 9.0.122 respectively; 8.5.88 through 8.5.100 are also known affected but were end of life when the CVE was created.
What is the impact if a server is vulnerable?
The flaw can enable a denial-of-service attack through uncontrolled resource consumption while Tomcat sends a WebSocket close message. The described behavior involves a busy wait during WebSocket connection closure.
Are older unsupported Tomcat releases potentially affected?
Yes. In addition to the identified affected 8.5 releases, other unsupported Tomcat versions may also be affected.