https://seclists.org/oss-sec/2026/q3/906: CVE-2026-79677: Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout
Published Sep 23, 2026
·Updated
Affected Software
1 affected component
Apache Tomcat>=11.0.0-M1<=11.0.25, >=10.1.0-M1<=10.1.59, >=9.0.0.M1<=9.0.121, >=8.5.0<=8.5.100, >=7.0.43<=7.0.109
Frequently Asked Questions
1
Which Tomcat releases are affected, and which are unaffected?
Affected ranges are Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, 8.5.0 through 8.5.100, and 7.0.43 through 7.0.109. Tomcat versions before 7.0.43 are identified as unaffected.
2
What is the impact of this issue?
The issue is a moderate-severity denial of service condition involving a lost asynchronous WebSocket write timeout.