CVE-2026-66299

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue. Users are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/8owczcc1o8qw1rxmg9gvfk4w2jnh4l5k	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/07/28/25	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:tomcat::::::::
	cpe:2.3:a:apache:tomcat::::::::
	cpe:2.3:a:apache:tomcat::::::::
	cpe:2.3:a:apache:tomcat:11.0.0:milestone20::::::
	cpe:2.3:a:apache:tomcat:11.0.0:milestone21::::::
	cpe:2.3:a:apache:tomcat:11.0.0:milestone22::::::
	cpe:2.3:a:apache:tomcat:11.0.0:milestone23::::::
	cpe:2.3:a:apache:tomcat:11.0.0:milestone24::::::
	cpe:2.3:a:apache:tomcat:11.0.0:milestone25::::::
	cpe:2.3:a:apache:tomcat:11.0.0:milestone26::::::

History

No history.

Information

Published : 2026-07-28 15:17

Updated : 2026-08-27 16:24

NVD link : CVE-2026-66299

Mitre link : CVE-2026-66299

CVE.ORG link : CVE-2026-66299

JSON object : View

Products Affected

apache

tomcat

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2026-66299", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66299", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T17:39:48.240123Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Tomcat", "versions": [{"status": "affected", "version": "11.0.0-M20", "versionType": "semver", "lessThanOrEqual": "11.0.24"}, {"status": "affected", "version": "10.1.24", "versionType": "semver", "lessThanOrEqual": "10.1.57"}, {"status": "affected", "version": "9.0.89", "versionType": "semver", "lessThanOrEqual": "9.0.120"}, {"status": "unaffected", "version": "0", "versionType": "semver", "lessThanOrEqual": "8.5.100"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-28T15:17:50.210", "references": [{"url": "https://lists.apache.org/thread/8owczcc1o8qw1rxmg9gvfk4w2jnh4l5k", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/28/25", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example.\n\nThis issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue.\n\nUsers are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue."}], "lastModified": "2026-08-27T16:24:41.670", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4B8784DF-337E-4955-B7B4-B352E17A51D3", "versionEndExcluding": "9.0.121", "versionStartIncluding": "9.0.89"}, {"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "603322DF-B852-4112-A8E7-0447A122A894", "versionEndExcluding": "10.1.58", "versionStartIncluding": "10.1.24"}, {"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DF30E912-1C80-4AEA-8C14-BB32B416EFEA", "versionEndExcluding": "11.0.25", "versionStartIncluding": "11.0.1"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone20:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77BA6600-0890-4BA1-B447-EC1746BAB4FD"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone21:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7914D26B-CBD6-4846-9BD3-403708D69319"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone22:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "123C6285-03BE-49FC-B821-8BDB25D02863"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone23:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A28C2E2-B7BC-46CE-94E4-AE3EF172AA47"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone24:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "069B0D8E-8223-4C4E-A834-C6235D6C3450"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone25:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E6282085-5716-4874-B0B0-180ECDEE128F"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone26:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "899B6FF0-8701-47E7-8EDA-428A6D48786D"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}