Response mix-up with WebSocket concurrent send and close

Vulnerability

A race condition exists in Apache Tomcat's WebSocket handling when a web application sends a WebSocket message concurrently with the WebSocket connection closing. This affects versions 8.5.0 to 8.5.75 and 9.0.0.M1 to 9.0.20. The error handling in this scenario can cause a pooled object to be placed in the pool twice, leading to subsequent connections using the same object concurrently [1].

Exploitation

An attacker must be able to establish a WebSocket connection and send a message while the server is closing the connection. The exploit requires precise timing to trigger the race condition. No authentication is required beyond the ability to create a WebSocket connection, although the web application must be configured to use WebSockets [1].

Impact

Successful exploitation can result in data being returned to the wrong user or other errors, potentially leading to information disclosure or data corruption. The attacker does not gain code execution or elevated privileges, but the integrity and confidentiality of data may be compromised [1].

Mitigation

Not yet disclosed in the available references. Users should monitor Apache Tomcat security advisories for fixed versions. The vulnerability is present in the affected ranges, so upgrading to a later version (e.g., 8.5.76+ or 9.0.21+) may resolve the issue, but confirmation is pending [1].