Skip to main content

Apache Tomcat CVE-2026-66299

| EUVDEUVD-2026-49855 MEDIUM
Uncontrolled Resource Consumption (CWE-400)
2026-07-28 apache GHSA-rpf9-hrjr-88fv
Denial Of Service Apache Tomcat Apache Tomcat Apache Software Foundation
Medium
Disputed · 5.3 NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Connect to Tomcat WebSocket endpoint
  2. Exploit
    Send crafted WebSocket frames
  3. Execution
    Trigger resource exhaustion
  4. Impact
    Service becomes unresponsive

Vulnerability Assessment

Weakness
CWE
CWE-400
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The Apache Tomcat examples web application must be present and accessible, with the WebSocket chat example specifically reachable. This is a default inclusion in the Tomcat distribution, but security best practices and vendor guidance recommend its removal. If the examples webapp has been deleted or access to its endpoints is restricted, the vulnerability cannot be exploited.
Impact

CVSS vector is not provided by NVD or the vendor; an analyst‑assessed vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields a score of 7.5 (High). EPSS exploitation probability is unknown, and the vulnerability is not listed in CISA’s KEV catalog, indicating no observed active exploitation. The vulnerable component is a non‑essential example application that security guidance explicitly advises to remove, which drastically reduces real‑world exposure. While the attack is low‑complexity and unauthenticated, the overall risk to well‑managed deployments is low due to the ease of mitigation and the non‑default nature of a production‑hardened Tomcat configuration.
Exploit ScenarioDerived

An attacker sends crafted WebSocket messages to the publicly exposed /examples/websocket/chat endpoint of an unpatched Tomcat server that still includes the examples webapp. By continuously sending specially formatted frames, the attacker triggers excessive CPU or memory consumption, causing the server to become unresponsive and denying service to legitimate users.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 28, 2026

Uncontrolled resource consumption in Apache Tomcat's default WebSocket chat example allows remote attackers to cause denial of service. Affected versions include 11.0.0-M20 through 11.0.24, 10.1.24 through 10.1.57, and 9.0.89 through 9.0.120; users who have removed the examples web application as recommended are not impacted. No public exploit code or active exploitation is reported.

RemediationAI

The primary remediation is to remove the examples web application from the Tomcat installation, which is already recommended in the security guidance for production deployments. If removal is not immediately possible, upgrading to Apache Tomcat 11.0.25, 10.1.58, or 9.0.121 (once released) eliminates the vulnerability. No runtime workarounds are provided; blocking access to the /examples/websocket/chat path via a reverse proxy or firewall can serve as a temporary compensating control, but complete removal is the only certain fix.

Affected VersionsENISA

Apache Tomcat 11.0.0-M20 ≤11.0.24
Apache Tomcat 9.0.89 ≤9.0.120
Apache Tomcat 10.1.24 ≤10.1.57

Affected Packages

euvd apache_tomcat no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability exists in the WebSocket chat example bundled with Apache Tomcat, which implements real‑time messaging using the Java WebSocket API (JSR 356). CWE‑400 (Uncontrolled Resource Consumption) indicates that the example fails to properly limit resource allocation when handling certain inputs, allowing an attacker to exhaust server resources. CPE cpe:2.3:a:apache_software_foundation:apache_tomcat:*:*:*:*:*:*:*:* confirms that all Tomcat instances within the stated version ranges are affected if the examples webapp is present. The root cause is a lack of rate‑limiting or input validation in the demo application, not in the core Tomcat container.

Know when Apache Tomcat gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)
Vendor (apache) PRIMARY LOW
NVD 5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vuln.today AI 7.5 HIGH

Network‑reachable example with no authentication; only availability impact from resource exhaustion.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.3 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

4
Severity Changed
Aug 27, 2026 - 16:37 NVD
HIGH MEDIUM
CVSS changed
Aug 27, 2026 - 16:37 NVD
7.5 (HIGH) 5.3 (MEDIUM)
CVSS changed
Jul 28, 2026 - 18:22 NVD
7.5 (HIGH)
CVE Published
Jul 28, 2026 - 14:29 cve.org
LOW

DescriptionNVD

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example.

This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue.

Users are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue.

Articles & Coverage 1

News 4 New Apache Vulnerabilities - 1 Critical, 3 High Jul 29, 2026

Threat Intelligence Overview

EPSS Score
0.3%
Top 77% exploitable
Prevalence
High
widely deployed web container; examples webapp often present in testing but removed in production
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.3%
Patch available No
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact· derived
High
Technical Impact
Partial

Priority Score

26
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +26
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Apache Tomcat

View all
CVE-2026-34486 HIGH POC
7.5 Apr 09

Missing encryption of cluster replication traffic in Apache Tomcat 11.0.20, 10.1.53, and 9.0.116 exposes sensitive sessi
CVE-2026-29146 HIGH POC
7.5 Apr 09

Padding oracle attack in Apache Tomcat EncryptInterceptor leaks encrypted session data confidentiality across versions 7
CVE-2026-50229 MEDIUM POC
6.1 Jun 29

Reflected XSS in Apache Tomcat's bundled 'number guess' example application exposes users of that demo page to script in
CVE-2026-76183 CRITICAL
9.8 Sep 23

Authentication bypass in Apache Tomcat allows unauthenticated remote attackers to reach WebSocket endpoints that are sup
CVE-2026-43512 CRITICAL
9.8 May 12

Authentication bypass in Apache Tomcat's DIGEST authentication implementation allows remote attackers to circumvent HTTP
CVE-2026-41293 CRITICAL
9.8 May 12

Improper input validation in Apache Tomcat (CWE-20) affects a broad range of releases across the 8.5, 9.0, 10.0, 10.1, a
CVE-2026-29145 CRITICAL
9.1 Apr 09

Authentication bypass in Apache Tomcat 9.x through 11.x and Tomcat Native 1.1.23-2.0.13 allows unauthenticated remote at
CVE-2026-43515 CRITICAL
9.1 May 12

Authorization bypass in Apache Tomcat (versions 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0.M1-9.0.117, 10.1.0-M1-10.1.54, and 1
CVE-2026-103119 CRITICAL
9.1 Oct 20

Apache Tomcat 11.0.0-M25 through 11.0.26 can split the body of a large non-blocking (NIO) response across the current re
CVE-2026-101356 CRITICAL
9.1 Oct 20

Apache Tomcat 11.0.22-11.0.26, 10.1.55-10.1.60, and 9.0.118-9.0.122 contain an object-recycling race in HTTP/2 processin
CVE-2026-101296 CRITICAL
9.1 Oct 20

Authentication bypass in Apache Tomcat's JNDI realm allows unauthenticated remote attackers to log in without a valid pa
CVE-2026-86350 CRITICAL
9.1 Sep 23

HTTP/2 request smuggling in Apache Tomcat can mix up request headers between concurrent streams, allowing unauthenticate

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2021-21341 HIGH POC
7.5
CVE-2022-29885 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected

References

Advisories & patches
ADVISORY https://lists.apache.org/thread/8owczcc1o8qw1rxmg9gvfk4w2jnh4l5k ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-66299 ADVISORY https://seclists.org/oss-sec/2026/q3/313 ADVISORY https://vuldb.com/vuln/383887 REF http://www.openwall.com/lists/oss-security/2026/07/28/25

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy