CVE-2026-77791: Apache Tomcat: DoS via busy wait during WebSocket close
Apache Tomcat WebSocket close handling can busy-wait, enabling denial of service across multiple supported versions.
Apache disclosed CVE-2026-77791, an important uncontrolled resource consumption bug in Tomcat. Sending a WebSocket close message can enter a busy wait and enable denial of service. Affected ranges are 11.0.0-M5 through 11.0.25, 10.1.8 through 10.1.59, 9.0.74 through 9.0.121, 8.5.88 through 8.5.100, and Tomcat through 7.0.109. The advisory does not report active exploitation.
- CVE-2026-77791 is an uncontrolled resource consumption flaw in Apache Tomcat.
- A busy wait while sending a WebSocket close message can cause denial of service.
- Affects 11.0.0-M5–11.0.25, 10.1.8–10.1.59, 9.0.74–9.0.121, 8.5.88–8.5.100, and through 7.0.109.
- Apache rates the issue important; the notice does not report exploitation.
- CVEs
- CVE-2026-77791
- Vendors
- Apache
- Products
- Apache Tomcat
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-77791 | Denial of Service in Apache Tomcat WebSocket Close Message Handling | 7.5 | — |
From the original article
Posted by Mark Thomas on Sep 23 Severity: important Affected versions: - Apache Tomcat 11. 0. 0-M5 through 11.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.