CVE-2026-79677: Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout
Apache Tomcat patches a moderate WebSocket denial of service caused by a lost write timeout.
Mark Thomas disclosed CVE-2026-79677, a moderate-severity denial of service in Apache Tomcat WebSocket handling. A resource is not released after its effective lifetime when an asynchronous write timeout is lost. Affected builds include 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, 8.5.0 through 8.5.100, and 7.0.43 through 7.0.109. Versions before 7.0.43 are unaffected, and exploitation is not reported.
- Moderate WebSocket denial of service from a lost asynchronous write timeout
- Affects Tomcat 7.0.43-7.0.109 plus 8.5, 9.0, 10.1, and 11.0 lines
- Releases before Tomcat 7.0.43 are unaffected
- No in-the-wild exploitation is reported
- CVEs
- CVE-2026-79677
- Vendors
- Apache
- Products
- Apache Tomcat
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-79677 | WebSocket Async Write Timeout DoS in Apache Tomcat | 7.5 | — |
From the original article
Posted by Mark Thomas on Sep 23 Severity: moderate Affected versions: - Apache Tomcat 11. 0. 0-M1 through 11.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.