CVE-2026-66299: Apache Tomcat: DoS via WebSocket chat example

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-28 · updated 2026-10-24
Weakness: CWE-400

Description

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue. Users are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue.

Affected products

Apache Tomcat: from 9.0.89 before 9.0.121; from 10.1.24 before 10.1.58; from 11.0.1 before 11.0.25; 11.0.0-milestone20, 11.0.0-milestone21, 11.0.0-milestone22, 11.0.0-milestone23, 11.0.0-milestone24, 11.0.0-milestone25 (+1) — fixed in 10.1.58, 11.0.25, 9.0.121

How to fix

Upgrade to a fixed version: Apache Tomcat 10.1.58, 11.0.25, 9.0.121. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-66299 or the next vulnerability affects your stack