Vulnerability Description
Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue. Users are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Tomcat | >= 9.0.89, < 9.0.121 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread/8owczcc1o8qw1rxmg9gvfk4w2jnh4l5kMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/07/28/25Mailing ListThird Party Advisory
FAQ
What is CVE-2026-66299?
CVE-2026-66299 is a vulnerability with a CVSS score of 7.5 (HIGH). Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89...
How severe is CVE-2026-66299?
CVE-2026-66299 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-66299?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Tomcat.