CVE-2026-87022
Apache Tomcat: WebSocket message smuggling with per-message-deflate
Technology
Apache Tomcat
CVSS Score
7.5 / 10.0
Affected Versions
11.0.0-M1 to 11.0.25; 10.1.0-M1 to 10.1.59; 9.0.0.M1 to 9.0.121; end of support but known affected: 8.5.0 to 8.5.100, 7.0.56 to 7.0.109
Upstream Fix
11.0.26; 10.1.60; 9.0.122
Published
September 23, 2026
OSSeva Coverage
Fixed upstream
Description
Improper handling of a length parameter allowed WebSocket message smuggling when per-message-deflate is used. Made public on 23 September 2026 and rated Low by the Tomcat security team. Fixed in 11.0.26, 10.1.60 and 9.0.122 (the NVD description gives 9.1.22, a typo for 9.0.122).
Is your Apache Tomcat deployment affected?
If you're running 11.0.0-M1 to 11.0.25; 10.1.0-M1 to 10.1.59; 9.0.0.M1 to 9.0.121; end of support but known affected: 8.5.0 to 8.5.100, 7.0.56 to 7.0.109, you need this patch. Book a discovery call to get covered.
Get a quote
Running Apache Tomcat 11.0.0-M1 to 11.0.25; 10.1.0-M1 to 10.1.59; 9.0.0.M1 to 9.0.121; end of support but known affected: 8.5.0 to 8.5.100, 7.0.56 to 7.0.109?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?