CVE-2026-66299 in Tomcat
Summary
by MITRE • 07/28/2026
Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example.
This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue.
Users are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
The vulnerability under discussion represents an uncontrolled resource consumption flaw within Apache Tomcat's WebSocket chat example implementation, classified as a denial of service condition that can lead to system instability and resource exhaustion. This weakness allows malicious actors to consume excessive computational resources through crafted WebSocket messages, potentially leading to complete service disruption for legitimate users. The vulnerability specifically impacts versions of Apache Tomcat spanning multiple release lines including 11.0.0-M20 through 11.0.24, 10.1.24 through 10.1.57, and 9.0.89 through 9.0.120, indicating a widespread issue affecting the core WebSocket functionality within these software versions.
The technical mechanism behind this vulnerability stems from inadequate input validation and resource management within the WebSocket chat example application. When processing incoming WebSocket messages, the implementation fails to properly enforce limits on message size, frequency, or connection duration, allowing attackers to flood the server with resource-intensive operations. This flaw operates as a classic resource exhaustion attack pattern where malicious inputs cause the system to allocate increasingly more memory and CPU cycles without proper bounds checking or rate limiting mechanisms. The vulnerability manifests when the WebSocket chat example receives specially crafted messages that trigger excessive processing requirements, leading to gradual depletion of available system resources such as memory allocation, thread pools, and network connection handles.
From an operational impact perspective, this vulnerability creates significant security and availability concerns for affected Apache Tomcat deployments. Organizations running vulnerable versions may experience complete service outages, degraded performance, or unpredictable application behavior when subjected to exploitation attempts. The attack vector is particularly concerning because it can be executed through standard WebSocket connections without requiring authentication, making it easily exploitable by anyone with network access to the affected server. This vulnerability directly impacts the availability and integrity of web applications that rely on Tomcat's WebSocket capabilities, potentially affecting critical business operations where real-time communication services are essential.
The recommended mitigations for this vulnerability align with established security practices including immediate version upgrades to patched releases or complete removal of the examples web application. Organizations should prioritize upgrading to Apache Tomcat versions 11.0.25, 10.1.58, or 9.0.121 once released, which contain proper fixes addressing the resource consumption limitations in the WebSocket chat example. Additionally, implementing network-level restrictions to limit WebSocket connections, establishing connection rate limiting policies, and monitoring for unusual resource utilization patterns can provide additional defense-in-depth measures. The vulnerability's classification aligns with CWE-400, which specifically addresses uncontrolled resource consumption, and represents a potential ATT&CK technique under T1499.004 for network denial of service attacks.
Security practitioners should recognize that removing the examples web application entirely eliminates this specific risk vector while maintaining the core Tomcat functionality. This approach provides immediate protection without requiring software updates or complex configuration changes, making it particularly suitable for environments where rapid remediation is required. Organizations should also conduct comprehensive vulnerability assessments to identify other potentially exposed WebSocket implementations within their infrastructure and ensure proper resource management policies are implemented across all WebSocket-enabled applications. The vulnerability demonstrates the importance of maintaining secure default configurations and implementing proper input validation mechanisms in web application frameworks, particularly those handling real-time communication protocols.