HIGHFixed upstream

CVE-2026-79677

Apache Tomcat: WebSocket denial of service from lost asynchronous write timeouts

Technology

Apache Tomcat

CVSS Score

7.5 / 10.0

Affected Versions

11.0.0-M1 to 11.0.25; 10.1.0-M1 to 10.1.59; 9.0.0.M1 to 9.0.121; end of life but known affected: 8.5.0 to 8.5.100, 7.0.43 to 7.0.109

Upstream Fix

11.0.26; 10.1.60; 9.0.122

Published

September 23, 2026

OSSeva Coverage

Fixed upstream

Description

A concurrency bug meant time outs for asynchronous WebSocket writes could be lost, which an attacker could use for denial of service. Made public on 23 September 2026 and rated Moderate by the Tomcat security team. Fixed in 11.0.26, 10.1.60 and 9.0.122.

Upstream record: NVD · CVE.org

Is your Apache Tomcat deployment affected?

If you're running 11.0.0-M1 to 11.0.25; 10.1.0-M1 to 10.1.59; 9.0.0.M1 to 9.0.121; end of life but known affected: 8.5.0 to 8.5.100, 7.0.43 to 7.0.109, you need this patch. Book a discovery call to get covered.

Book a discovery call View Apache Tomcat coverage →

Get a quote

Running Apache Tomcat 11.0.0-M1 to 11.0.25; 10.1.0-M1 to 10.1.59; 9.0.0.M1 to 9.0.121; end of life but known affected: 8.5.0 to 8.5.100, 7.0.43 to 7.0.109?

Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.

Prefer to talk or read more first?

Book a 15-minute call Apache Tomcat support