CVE-2026-79677
Received Received - Intake

Denial of Service in Apache Tomcat via WebSocket Timeout

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: Apache Software Foundation

Description
Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-79677
EUVD
EUVD-2026-85232

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
apache tomcat From 11.0.0-M1 (inc) to 11.0.25 (inc)
apache tomcat From 10.1.0-M1 (inc) to 10.1.59 (inc)
apache tomcat From 9.0.0.M1 (inc) to 9.0.121 (inc)
apache tomcat From 8.5.0 (inc) to 8.5.100 (inc)
apache tomcat From 7.0.43 (inc) to 7.0.109 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-772 The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
CWE-1025 The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Apache Tomcat involves two issues: missing release of resources after their lifetime and incorrect comparison using wrong factors. It specifically affects asynchronous WebSocket writes, causing lost timeouts that can lead to a denial of service.

Detection Guidance

Detection involves checking Tomcat versions against affected ranges. Use commands like 'catalina.sh version' or 'java -cp catalina.jar org.apache.catalina.util.ServerInfo' to verify installed versions. Monitor logs for WebSocket timeouts or unusual delays in asynchronous writes.

Impact Analysis

The vulnerability can cause a denial of service by disrupting asynchronous WebSocket writes due to lost timeouts. This may result in service unavailability or degraded performance for applications relying on Tomcat's WebSocket functionality.

Compliance Impact

This vulnerability causes denial of service due to lost timeouts for asynchronous WebSocket writes, which could disrupt system availability. While not directly impacting data protection or privacy controls, prolonged downtime may indirectly affect compliance with standards requiring system availability (e.g., HIPAA for healthcare systems). No specific compliance impact is mentioned in the provided context.

Mitigation Strategies

Upgrade Apache Tomcat to version 11.0.26, 10.1.60, or 9.0.122 to fix the issue. If using unsupported versions like 8.5.x or 7.0.x, upgrade to a supported version or apply patches if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79677. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart