EUVD-2026-66192
GHSA-wrvx-pxxf-g8fg
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Network vector confirmed by WebSocket/HTTP protocol scope; AC:H for required session-ID-rotation timing; PR:L for mandatory prior authentication; C:H/I:H for persistent unauthorized channel access; no availability impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.
The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
AnalysisAI
Insufficient session expiration in Apache Tomcat allows an authenticated attacker to maintain an active WebSocket connection after the underlying HTTP session has been invalidated, violating the Jakarta WebSocket specification's requirement that WebSocket sessions close when their parent HTTP session ends. Affected are all supported branches from 9.0.0.M1 through 9.0.120, 10.1.0-M1 through 10.1.57, and 11.0.0-M1 through 11.0.24, plus EOL branches 7.0.43-7.0.109 and 8.5.0-8.5.100. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions to be met: (1) the attacker holds an authenticated HTTP session on the target Tomcat instance - PR:L per the supplied CVSS vector confirms authentication is required; (2) a WebSocket connection has been established and is active under that authenticated HTTP session prior to the attack; and (3) the HTTP session ID is changed or rotated - whether driven by application security logic (post-login session fixation defenses, privilege change workflows) or by attacker-influenced mechanisms. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The 6.8 CVSS score accurately reflects moderate-to-high severity with constrained exploitation difficulty: the network vector (AV:N) and high confidentiality/integrity impact (C:H/I:H) are balanced by high attack complexity (AC:H) and low-privilege requirements (PR:L), meaning an attacker must already hold authenticated access and orchestrate a specific session ID rotation event while a WebSocket connection is simultaneously active. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a valid authenticated session on a Tomcat-hosted application establishes a WebSocket connection, then triggers a session ID rotation - either through an application-level workflow such as a privilege escalation, re-authentication step, or an explicitly coded post-login session rotation - causing the original HTTP session to be invalidated. The WebSocket connection, which Tomcat fails to close as required by the specification, remains open and usable, allowing the attacker to continue interacting with the application endpoint over the persistent WebSocket channel beyond the intended session boundary. … |
| Remediation | The primary fix is to upgrade Apache Tomcat to version 11.0.25, 10.1.58, or 9.0.121 as recommended by the vendor advisory published via the Apache mailing list (https://lists.apache.org/thread/3j15vztszpyqss253mjq5v1kp7s6hooq) and oss-security (https://seclists.org/oss-sec/2026/q3/588). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a f
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products,
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to
When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)
java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and
Missing encryption of cluster replication traffic in Apache Tomcat 11.0.20, 10.1.53, and 9.0.116 exposes sensitive sessi
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today