CVE-2026-73180

Analyzed Analyzed - Analysis Complete

Insufficient Session Expiration in Apache Tomcat

Publication date: 2026-08-25

Last updated on: 2026-08-27

Assigner: Apache Software Foundation

Description

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-27

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-13

NVD

CVE-2026-73180

EUVD

EUVD-2026-66192

Affected Vendors & Products

Vendor	Product	Version / Range
apache	tomcat	From 10.1.0 (inc) to 10.1.58 (exc)
apache	tomcat	From 11.0.0 (inc) to 11.0.25 (exc)
apache	tomcat	From 7.0.43 (inc) to 7.0.109 (inc)
apache	tomcat	From 8.5.0 (inc) to 9.0.121 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-613	According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

Executive Summary

This vulnerability in Apache Tomcat involves insufficient session expiration. If a session ID is changed after a WebSocket connection is established under an authenticated HTTP session, the WebSocket session won't close when the HTTP session ends, violating the Jakarta WebSocket specification.

Detection Guidance

This vulnerability cannot be directly detected using commands as it involves improper session handling in Apache Tomcat. However, you can check your Tomcat version to see if it is affected. Run: 'catalina.sh version' or check the version in the logs. If your version is between 11.0.0-M1 to 11.0.24, 10.1.0-M1 to 10.1.57, 9.0.0.M1 to 9.0.120, or 8.5.0 to 8.5.100, it is vulnerable.

Impact Analysis

This could allow unauthorized access to persist even after the original authenticated session ends, potentially leading to data exposure or unauthorized actions. Attackers might exploit this to maintain access to resources.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in non-compliance due to insufficient session management and data protection measures.

Mitigation Strategies

Upgrade Apache Tomcat to version 11.0.25, 10.1.58, or 9.0.121, which fix the issue. If using unsupported versions like 8.5.x or 7.0.x, upgrade to a supported version immediately.

Hi! I’m here to help you understand CVE-2026-73180. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70