Apache Tomcat up to 11.0.25 denial of service

Summaryinfo

A vulnerability was found in Apache Tomcat 7.0.109/8.5.100/9.0.121/10.1.59/11.0.25. It has been declared as problematic. The impacted element is an unknown function. Such manipulation leads to denial of service. This vulnerability is uniquely identified as CVE-2026-79677. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Apache Tomcat 7.0.109/8.5.100/9.0.121/10.1.59/11.0.25. It has been rated as problematic. Affected by this issue is some unknown processing. The manipulation with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability. CVE summarizes:

Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

The advisory is shared for download at lists.apache.org. This vulnerability is handled as CVE-2026-79677 since 08/25/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 09/24/2026). The MITRE ATT&CK project declares the attack technique as T1499.

The vulnerability scanner Nessus provides a plugin with the ID 349597 (Linux Distros Unpatched Vulnerability : CVE-2026-79677), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 11.0.26, 10.1.60 or 9.0.122 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (349597) and CERT Bund (WID-SEC-2026-3527). Once again VulDB remains the best source for vulnerability data.

Affected

• Apache Tomcat

Productinfo

Type

• Application Server Software

Vendor

• Apache

Name

• Tomcat

Version

• 7.0.109
• 8.5.100
• 9.0.121
• 10.1.59
• 11.0.25

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion