CVE-2026-87022: Apache Tomcat: WebSocket message smuggling with per-message-deflate
Apache Tomcat can smuggle WebSocket messages when per-message-deflate length handling is inconsistent.
Mark Thomas reported CVE-2026-87022, a low-severity Apache Tomcat flaw in handling inconsistent WebSocket length parameters when per-message-deflate is enabled. It can allow WebSocket message smuggling. Affected ranges include Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, 8.5.0 through 8.5.100, and 7.0.56 through 7.0.109. The disclosure does not report active exploitation.
- Affects Tomcat 7 through 11 and is rated low.
- Per-message-deflate length inconsistency allows WebSocket message smuggling.
- No in-the-wild exploitation is described in the advisory.
- CVEs
- CVE-2026-87022
- Vendors
- Apache
- Products
- Apache Tomcat
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87022 | WebSocket Message Smuggling in Apache Tomcat via per-message-deflate | 7.5 | — |
From the original article
Posted by Mark Thomas on Sep 23 Severity: low Affected versions: - Apache Tomcat 11. 0. 0-M1 through 11.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.