What is the CVSS score of EUVD-2026-49855?

EUVD-2026-49855 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Apache Tomcat EUVD-2026-49855

| CVE-2026-66299 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-28 apache

GHSA-rpf9-hrjr-88fv

Denial Of Service Apache Tomcat Apache Tomcat

7.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.5 LOW

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network‑reachable example with no authentication; only availability impact from resource exhaustion.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Jul 28, 2026 - 18:22 NVD

7.5 (HIGH)

Analysis Generated

Jul 28, 2026 - 15:19 vuln.today

CVE Published

Jul 28, 2026 - 14:29 cve.org

LOW

DescriptionCVE.org

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example.

This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue.

Users are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue.

Articles & Coverage 1

News 4 New Apache Vulnerabilities - 1 Critical, 3 High Jul 29, 2026

AnalysisAI

Uncontrolled resource consumption in Apache Tomcat's default WebSocket chat example allows remote attackers to cause denial of service. Affected versions include 11.0.0-M20 through 11.0.24, 10.1.24 through 10.1.57, and 9.0.89 through 9.0.120; users who have removed the examples web application as recommended are not impacted. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Connect to Tomcat WebSocket endpoint

Exploit

Send crafted WebSocket frames

Execution

Trigger resource exhaustion

Impact

Service becomes unresponsive

Access

Connect to Tomcat WebSocket endpoint

Exploit

Send crafted WebSocket frames

Execution

Trigger resource exhaustion

Impact

Service becomes unresponsive

Vulnerability AssessmentAI

Exploitation	The Apache Tomcat examples web application must be present and accessible, with the WebSocket chat example specifically reachable. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS vector is not provided by NVD or the vendor; an analyst‑assessed vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields a score of 7.5 (High). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker sends crafted WebSocket messages to the publicly exposed `/examples/websocket/chat` endpoint of an unpatched Tomcat server that still includes the examples webapp. By continuously sending specially formatted frames, the attacker triggers excessive CPU or memory consumption, causing the server to become unresponsive and denying service to legitimate users.
Remediation	The primary remediation is to remove the examples web application from the Tomcat installation, which is already recommended in the security guidance for production deployments. … Detailed patch versions, workarounds, and compensating controls in full report.