CVE-2026-77791

Apache Tomcat contains an uncontrolled resource consumption flaw (CWE-400) that is triggered while the server is sending a WebSocket close message, allowing a remote, unauthenticated attacker to exhaust resources and cause denial of service. The attack requires only the ability to open WebSocket connections to a Tomcat instance that serves WebSocket endpoints, with no privileges or user interaction needed. Successful exploitation degrades or takes down the availability of the affected server (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/A:H); confidentiality and integrity are not impacted. All currently supported Tomcat branches are affected within the listed version ranges, plus the end-of-life 8.5.x branch. As of this writing there is no known public proof of concept, the issue is not on the CISA KEV list, and no in-the-wild exploitation has been reported.

What to do: Upgrade to Apache Tomcat 11.0.26, 10.1.60, or 9.0.122 depending on your branch; 8.5.x is end-of-life, so migrate to a supported release rather than patching in place. If immediate patching is not possible, restrict or filter access to WebSocket endpoints (e.g., via reverse proxy rules or disabling unused WebSocket applications) and monitor Tomcat for abnormal connection churn, thread/memory exhaustion, and repeated WebSocket close activity.