CVE-2026-79677

Apache Tomcat mishandles the timeouts that govern asynchronous WebSocket writes, due to a missing release of resources after their effective lifetime combined with a comparison using wrong factors (CWE-772/CWE-1025). A malicious or misbehaving WebSocket client can cause these write timeouts to be lost, so connections, buffers, and associated server resources are never cleaned up and accumulate on the server. The impact is denial of service against applications hosting WebSocket endpoints, not data disclosure or code execution. All currently supported Tomcat branches are affected (11.0.0-M1–11.0.25, 10.1.0-M1–10.1.59, 9.0.0.M1–9.0.121), plus the EOL 8.5.0–8.5.100 and 7.0.43–7.0.109 ranges. There is no CVSS score yet, no public proof of concept, and no known exploitation in the wild.

What to do: Upgrade to Apache Tomcat 11.0.26, 10.1.60, or 9.0.122 depending on your branch; deployments on EOL 8.5.x or 7.0.x cannot receive a fix and should migrate to a supported release. If immediate patching is not possible, enforce authentication and rate limits on WebSocket endpoints, cap concurrent WebSocket connections per client, and alert on long-lived or stuck async-write sessions. After patching, verify that WebSocket write timeouts now fire correctly under load testing.