CVE-2026-79677: Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout
Apache Tomcat patches a moderate WebSocket denial of service caused by a lost write timeout.
Mark Thomas disclosed CVE-2026-79677, a moderate-severity denial of service in Apache Tomcat WebSocket handling. A resource is not released after its effective lifetime when an asynchronous write timeout is lost. Affected builds include 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, 8.5.0 through 8.5.100, and 7.0.43 through 7.0.109. Versions before 7.0.43 are unaffected, and exploitation is not reported.
- Moderate WebSocket denial of service from a lost asynchronous write timeout
- Affects Tomcat 7.0.43-7.0.109 plus 8.5, 9.0, 10.1, and 11.0 lines
- Releases before Tomcat 7.0.43 are unaffected
- No in-the-wild exploitation is reported
Vulnerabilities mentionedAll →
- CVE-2026-796777.5—WebSocket Async Write Timeout DoS in Apache Tomcatpublished · Apache Tomcat
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-79677 | WebSocket Async Write Timeout DoS in Apache Tomcat Apache Tomcat mishandles the timeouts that govern asynchronous WebSocket writes, due to a missing release of resources after their effective lifetime combined with a comparison using wrong factors (CWE-772/CWE-1025). A malicious or misbehaving WebSocket client can cause these write timeouts to be lost, so connections, buffers, and associated server resources are never cleaned up and accumulate on the server. The impact is denial of service against applications hosting WebSocket endpoints, not data disclosure or code execution. All currently supported Tomcat branches are affected (11.0.0-M1–11.0.25, 10.1.0-M1–10.1.59, 9.0.0.M1–9.0.121), plus the EOL 8.5.0–8.5.100 and 7.0.43–7.0.109 ranges. There is no CVSS score yet, no public proof of concept, and no known exploitation in the wild. |
Posted by Mark Thomas on Sep 23 Severity: moderate Affected versions: - Apache Tomcat 11.0.0-M1 through 11.0.25 - Apache Tomcat 10.1.0-M1 through 10.1.59 - Apache Tomcat 9.0.0.M1 through 9.0.121 - Apache Tomcat 8.5.0 through 8.5.100 - Apache Tomcat 7.0.43 through 7.0.109 - Apache Tomcat before 7.0.43 unaffected Description: Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a...
This source does not provide full text. Read it at seclists.org.