CVE-2026-87022: Apache Tomcat: WebSocket message smuggling with per-message-deflate
Apache Tomcat can smuggle WebSocket messages when per-message-deflate length handling is inconsistent.
Mark Thomas reported CVE-2026-87022, a low-severity Apache Tomcat flaw in handling inconsistent WebSocket length parameters when per-message-deflate is enabled. It can allow WebSocket message smuggling. Affected ranges include Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, 8.5.0 through 8.5.100, and 7.0.56 through 7.0.109. The disclosure does not report active exploitation.
- Affects Tomcat 7 through 11 and is rated low.
- Per-message-deflate length inconsistency allows WebSocket message smuggling.
- No in-the-wild exploitation is described in the advisory.
Vulnerabilities mentionedAll →
- CVE-2026-870227.5—WebSocket Message Smuggling in Apache Tomcat via per-message-deflatepublished · Apache Tomcat
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-87022 | WebSocket Message Smuggling in Apache Tomcat via per-message-deflate CVE-2026-87022 is a high-severity vulnerability in Apache Tomcat that allows WebSocket message smuggling when the 'per-message-deflate' compression extension is enabled. The flaw is due to improper handling of a length parameter, enabling an attacker to send a crafted WebSocket message that violates protocol expectations. This can lead to smuggling attacks, potentially causing request/response confusion and integrity violations between a front-end proxy and the Tomcat backend. The vulnerability affects a wide range of Tomcat versions across multiple major release lines. No public proof-of-concept exploit code is known to exist, and it is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Upgrade Apache Tomcat to the fixed versions: 11.0.26, 10.1.60, or 9.1.22. If upgrading immediately is not possible, disable the 'per-message-deflate' extension in your WebSocket configuration. Check application logs for suspicious WebSocket traffic patterns. |
Posted by Mark Thomas on Sep 23 Severity: low Affected versions: - Apache Tomcat 11.0.0-M1 through 11.0.25 - Apache Tomcat 10.1.0-M1 through 10.1.59 - Apache Tomcat 9.0.0.M1 through 9.0.121 - Apache Tomcat 8.5.0 through 8.5.100 - Apache Tomcat 7.0.56 through 7.0.109 Description: Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from...
This source does not provide full text. Read it at seclists.org.