CVE-2026-79677: Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout
Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121.
The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.26 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.60 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.122
Event History
Frequently Asked Questions
Which Tomcat release should we upgrade to?
Upgrade to Apache Tomcat 11.0.26, 10.1.60, or 9.0.122, depending on the supported release line in use. These versions fix the issue.
Are unsupported Tomcat versions affected?
Tomcat 8.5.0 through 8.5.100 and 7.0.43 through 7.0.109 are known to be affected despite being end of life when the CVE was created. Other unsupported versions may also be affected.
What is the impact of successful exploitation?
The vulnerability can cause a denial of service because timeouts for asynchronous WebSocket writes may be lost. The provided information does not describe any impact beyond denial of service.