AI analysis
Apache Tomcat contains an uncontrolled resource consumption flaw (CWE-400) that is triggered while the server is sending a WebSocket close message, allowing a remote, unauthenticated attacker to exhaust resources and cause denial of service. The attack requires only the ability to open WebSocket connections to a Tomcat instance that serves WebSocket endpoints, with no privileges or user interaction needed. Successful exploitation degrades or takes down the availability of the affected server (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/A:H); confidentiality and integrity are not impacted. All currently supported Tomcat branches are affected within the listed version ranges, plus the end-of-life 8.5.x branch. As of this writing there is no known public proof of concept, the issue is not on the CISA KEV list, and no in-the-wild exploitation has been reported.
What to do: Upgrade to Apache Tomcat 11.0.26, 10.1.60, or 9.0.122 depending on your branch; 8.5.x is end-of-life, so migrate to a supported release rather than patching in place. If immediate patching is not possible, restrict or filter access to WebSocket endpoints (e.g., via reverse proxy rules or disabling unused WebSocket applications) and monitor Tomcat for abnormal connection churn, thread/memory exhaustion, and repeated WebSocket close activity.
Affected
| Apache Tomcat | 11.0.0-M5 through 11.0.25 |
| Apache Tomcat | 10.1.8 through 10.1.59 |
| Apache Tomcat | 9.0.74 through 9.0.121 |
| Apache Tomcat | 8.5.88 through 8.5.100 (EOL at time of CVE creation; other unsupported versions may also be affected) |
Estimated exposure
massHundreds of thousands of internet-exposed Tomcat servers, out of millions of deployments overall — Tomcat is one of the most widely deployed Java application servers, and public scan engines (Shodan/Censys) typically enumerate several hundred thousand internet-facing Tomcat banners; only the subset with exposed WebSocket endpoints is…
Description
Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.88 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.