CVE-2026-87022
Received Received - Intake

WebSocket Message Smuggling in Apache Tomcat

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: Apache Software Foundation

Description
Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.56 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.1.22, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-87022
EUVD
EUVD-2026-85236

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
apache tomcat From 11.0.0-M1 (inc) to 11.0.25 (inc)
apache tomcat From 10.1.0-M1 (inc) to 10.1.59 (inc)
apache tomcat From 9.0.0.M1 (inc) to 9.0.121 (inc)
apache tomcat From 8.5.0 (inc) to 8.5.100 (inc)
apache tomcat From 7.0.56 (inc) to 7.0.109 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-130 The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Apache Tomcat involves improper handling of length parameters when using WebSocket message compression (per-message-deflate). This can allow an attacker to smuggle malicious WebSocket messages by manipulating the length values, potentially bypassing security controls or injecting unauthorized data.

Detection Guidance

Detection involves checking Tomcat versions and WebSocket configurations. Use commands like 'catalina.sh version' or 'tomcat9 version' to verify installed versions. Inspect WebSocket settings in server.xml for per-message-deflate usage. Monitor logs for WebSocket-related errors or smuggling attempts.

Impact Analysis

If you use affected Apache Tomcat versions with WebSocket and per-message-deflate enabled, an attacker could exploit this to smuggle messages, leading to data breaches, unauthorized access, or disruption of services. Upgrading to patched versions mitigates this risk.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Organizations must patch systems to maintain compliance and prevent potential fines or legal consequences.

Mitigation Strategies

Upgrade Apache Tomcat to version 11.0.26, 10.1.60, or 9.1.22 or later to fix the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87022. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart