AI analysis
CVE-2026-87022 is a high-severity vulnerability in Apache Tomcat that allows WebSocket message smuggling when the 'per-message-deflate' compression extension is enabled. The flaw is due to improper handling of a length parameter, enabling an attacker to send a crafted WebSocket message that violates protocol expectations. This can lead to smuggling attacks, potentially causing request/response confusion and integrity violations between a front-end proxy and the Tomcat backend. The vulnerability affects a wide range of Tomcat versions across multiple major release lines. No public proof-of-concept exploit code is known to exist, and it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
What to do: Upgrade Apache Tomcat to the fixed versions: 11.0.26, 10.1.60, or 9.1.22. If upgrading immediately is not possible, disable the 'per-message-deflate' extension in your WebSocket configuration. Check application logs for suspicious WebSocket traffic patterns.
Affected
| Apache Tomcat | 11.0.0-M1 through 11.0.25 |
| Apache Tomcat | 10.1.0-M1 through 10.1.59 |
| Apache Tomcat | 9.0.0.M1 through 9.0.121 |
| Apache Tomcat | 8.5.0 through 8.5.100 (EOS) |
| Apache Tomcat | 7.0.56 through 7.0.109 (EOS) |
Estimated exposure
massmillions of servers — Apache Tomcat is one of the most widely deployed web servers and servlet containers, with millions of internet-facing installations globally.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.56 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.1.22, which fix the issue.