Uncontrolled Resource Consumption Vulnerability in Apache Tomcat
CVE-2026-77791

7.5HIGH

Key Information:

Vendor

Apache
Status
Apache Tomcat
Vendor
CVE Published:
23 September 2026

What is CVE-2026-77791?

An uncontrolled resource consumption vulnerability exists in Apache Tomcat when handling the WebSocket close message, which can lead to denial of service (DoS) attacks. This vulnerability affects several versions of Apache Tomcat, including some that have reached end-of-life. It is crucial for users to upgrade to the latest supported versions to mitigate this risk.

Affected Version(s)

Apache Tomcat 11.0.0-M5 <= 11.0.25

Apache Tomcat 10.1.8 <= 10.1.59

Apache Tomcat 9.0.74 <= 9.0.121

References

https://lists.apache.org/thread/mb1pjjooqytrl6hbvbt3rw1lq...
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.