HIGHFixed upstream

CVE-2026-77791

Apache Tomcat: denial of service via busy wait during WebSocket close

Technology

Apache Tomcat

CVSS Score

7.5 / 10.0

Affected Versions

11.0.0-M5 to 11.0.25; 10.1.8 to 10.1.59; 9.0.74 to 9.0.121; end of life but known affected: 8.5.88 to 8.5.100

Upstream Fix

11.0.26; 10.1.60; 9.0.122

Published

September 23, 2026

OSSeva Coverage

Fixed upstream

Description

A busy wait while sending a WebSocket close message allowed a denial of service attack. Made public on 23 September 2026 and rated Important by the Tomcat security team. Fixed in 11.0.26, 10.1.60 and 9.0.122.

Upstream record: NVD · CVE.org

Is your Apache Tomcat deployment affected?

If you're running 11.0.0-M5 to 11.0.25; 10.1.8 to 10.1.59; 9.0.74 to 9.0.121; end of life but known affected: 8.5.88 to 8.5.100, you need this patch. Book a discovery call to get covered.

Book a discovery call View Apache Tomcat coverage →

Get a quote

Running Apache Tomcat 11.0.0-M5 to 11.0.25; 10.1.8 to 10.1.59; 9.0.74 to 9.0.121; end of life but known affected: 8.5.88 to 8.5.100?

Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.

Prefer to talk or read more first?

Book a 15-minute call Apache Tomcat support