Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-28T14:29:05 tomcat: Apache Tomcat: Denial of Service via WebSocket chat example 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CWE-770

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue. Users are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue.

A flaw was found in Apache Tomcat. This uncontrolled resource consumption vulnerability, located in the WebSocket chat example, allows a remote attacker to cause a Denial of Service (DoS) by exhausting system resources. This can lead to the affected system becoming unresponsive or crashing.

This Moderate severity flaw in Apache Tomcat's WebSocket chat example could lead to a denial of service. The impact is limited as the vulnerable component is part of an example application, which is generally not deployed in production environments. Exploitation requires the example application to be present and accessible. To mitigate this vulnerability, remove the `examples` web application from your Apache Tomcat installation. This can typically be achieved by deleting the `examples` directory or `examples.war` file from the `webapps` directory of your Tomcat installation. A restart of the Tomcat service may be required for the changes to take full effect. Red Hat Enterprise Linux 10 Fix deferred tomcat Red Hat Enterprise Linux 10 Fix deferred tomcat9 Red Hat Enterprise Linux 6 Not affected tomcat6 Red Hat Enterprise Linux 7 Not affected tomcat Red Hat Enterprise Linux 8 Fix deferred pki-servlet-engine Red Hat Enterprise Linux 8 Fix deferred tomcat Red Hat Enterprise Linux 9 Fix deferred tomcat Red Hat Hardened Images Affected tomcat10 Red Hat Hardened Images Affected tomcat11 Red Hat JBoss Web Server 5 Not affected jws5-tomcat Red Hat JBoss Web Server 6 Not affected jws6-tomcat Red Hat JBoss Web Server 7 Not affected tomcat https://www.cve.org/CVERecord?id=CVE-2026-66299 https://nvd.nist.gov/vuln/detail/CVE-2026-66299 https://lists.apache.org/thread/8owczcc1o8qw1rxmg9gvfk4w2jnh4l5k