BIT-tomcat-2026-77791

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/tomcat/BIT-tomcat-2026-77791.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-tomcat-2026-77791

Aliases

CVE-2026-77791

Published

2026-10-01T09:36:29Z

Modified

2026-10-01T10:00:03Z

Summary

Apache Tomcat: DoS via busy wait during WebSocket close

Details

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack.

This issue affects Apache Tomcat: from 11.0.0 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121.

The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.88 through 8.5.100. Other unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

Database specific

{
    "cpes":  [
        "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:*:*:*:*:*:maven:*:*"
    ],
    "severity":  "High"
}

References

Affected packages

Bitnami / tomcat

Package

Name: tomcat
Purl: pkg:bitnami/tomcat

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

8.5.88

Fixed

9.0.45

Introduced

9.0.74

Fixed

9.0.122

Introduced

10.1.8

Fixed

10.1.60

Introduced

11.0.0

Fixed

11.0.26

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/tomcat/BIT-tomcat-2026-77791.json"