CVE-2026-77791— Apache Tomcat: DoS via busy wait during WebSocket close
Quick assessment
Affected
Apache Software Foundation Apache Tomcat
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The fol
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-77791
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Tomcat: DoS via busy wait during WebSocket close
Source: CVE Program / CVE List V5
Vulnerability Description
Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack.
This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.88 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Tomcat | 11.0.0-M5 ~ 11.0.25 | - |
|
II. Public POCs for CVE-2026-77791
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-77791
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-77791 (1)
Same Patch Batch · Apache Software Foundation · 2026-09-23 · 25 CVEs total
| CVE-2026-31377 | 7.5 HIGH | Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service |
| CVE-2026-75973 | Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured | |
| CVE-2026-82331 | Apache BuildStream: tar source extraction escape | |
| CVE-2026-73192 | Apache Sling XSS: XSS possible through XSSAPI.getValidHref() | |
| CVE-2026-92001 | Apache Sling XSS: Missing parser resource limits | |
| CVE-2026-91999 | Apache Sling XSS: Improper escaping in the XSS Webconsole plugin | |
| CVE-2026-91852 | Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl | |
| CVE-2026-96443 | Apache Doris: JDBC driver URL validation bypass leads to remote code execution | |
| CVE-2026-91928 | Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf prote | |
| CVE-2026-94251 | Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape | |
| CVE-2026-94243 | Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence | |
| CVE-2026-73581 | Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate us | |
| CVE-2026-86247 | Apache Tomcat Native: Client certificate requirements can be down-graded | |
| CVE-2026-76183 | Apache Tomcat: Bypass of security constraints for WebSocket endpoints | |
| CVE-2026-77756 | Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests | |
| CVE-2026-77762 | Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request | |
| CVE-2026-78383 | Apache Tomcat: AJP DoS via missing request body | |
| CVE-2026-78437 | Apache Tomcat: HTTP/2 DoS via malformed request | |
| CVE-2026-79677 | Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout | |
| CVE-2026-86248 | Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with |
Showing top 20 of 25 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache Tomcat
-
CVE-2026-87022
Apache Tomcat: WebSocket message smuggling with per-message- -
CVE-2026-86350
Apache Tomcat: Regression in fix for CVE-2026-41293 can trig -
CVE-2026-86248
Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP c -
CVE-2026-79677
Apache Tomcat: WebSocket DoS due to lost asynchronous write -
CVE-2026-78437
Apache Tomcat: HTTP/2 DoS via malformed request
Same vendor: Apache Software Foundation
-
CVE-2026-86247
Apache Tomcat Native: Client certificate requirements can be -
CVE-2026-86246
Apache Tomcat Native: Insecure OpenSSL options enabled -
CVE-2026-86243
Apache Tomcat Native: DoS via TLS handshake -
CVE-2026-87022
Apache Tomcat: WebSocket message smuggling with per-message- -
CVE-2026-86350
Apache Tomcat: Regression in fix for CVE-2026-41293 can trig
Same weakness: CWE-400
-
CVE-2026-6669
Unbounded SCRAM iteration count causes CPU exhaustion in PgB -
CVE-2026-91777
jackson-databind: quadratic forward-reference completion in -
CVE-2026-91776
jackson-databind: unbounded growth of the type id cache in T -
CVE-2026-57576
plone.app.dexterity and plone.app.contenttypes have a Denial -
CVE-2026-17465
Multiple Vulnerabilities in IBM Concert Software
V. Comments for CVE-2026-77791
No comments yet