AI analysis
Apache Tomcat mishandles the timeouts that govern asynchronous WebSocket writes, due to a missing release of resources after their effective lifetime combined with a comparison using wrong factors (CWE-772/CWE-1025). A malicious or misbehaving WebSocket client can cause these write timeouts to be lost, so connections, buffers, and associated server resources are never cleaned up and accumulate on the server. The impact is denial of service against applications hosting WebSocket endpoints, not data disclosure or code execution. All currently supported Tomcat branches are affected (11.0.0-M1–11.0.25, 10.1.0-M1–10.1.59, 9.0.0.M1–9.0.121), plus the EOL 8.5.0–8.5.100 and 7.0.43–7.0.109 ranges. There is no CVSS score yet, no public proof of concept, and no known exploitation in the wild.
What to do: Upgrade to Apache Tomcat 11.0.26, 10.1.60, or 9.0.122 depending on your branch; deployments on EOL 8.5.x or 7.0.x cannot receive a fix and should migrate to a supported release. If immediate patching is not possible, enforce authentication and rate limits on WebSocket endpoints, cap concurrent WebSocket connections per client, and alert on long-lived or stuck async-write sessions. After patching, verify that WebSocket write timeouts now fire correctly under load testing.
Affected
| Apache Tomcat | 11.0.0-M1 through 11.0.25 |
| Apache Tomcat | 10.1.0-M1 through 10.1.59 |
| Apache Tomcat | 9.0.0.M1 through 9.0.121 |
| Apache Tomcat | 8.5.0 through 8.5.100 (EOL) |
| Apache Tomcat | 7.0.43 through 7.0.109 (EOL) |
Estimated exposure
mass≈1M+ internet-reachable Tomcat instances plausibly running affected versions, of which only the WebSocket-enabled subset is practically exploitable — Apache Tomcat is one of the most widely deployed servlet containers, and public internet scans (Shodan/Censys-type data) commonly show on the order of a million exposed Tomcat services, with additional internal/enterprise deployments; the…
Description
Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.