High severity7.5NVD Advisory· Published Sep 23, 2026· Updated Sep 23, 2026
CVE-2026-77791
CVE-2026-77791
Description
Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack.
This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121.
The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.88 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
10- osv-coords9 versionspkg:rpm/opensuse/tomcat&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/tomcat10&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/tomcat11&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/tomcat10&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/libtcnative-2-0&distro=openSUSE%20Leap%2016.0pkg:bitnami/tomcatpkg:rpm/opensuse/libtcnative-1-0&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/tomcat11&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/tomcat&distro=openSUSE%20Leap%2016.0
< 9.0.122-1.1+ 8 more
- (no CPE)range: < 9.0.122-1.1
- (no CPE)range: < 10.1.60-1.1
- (no CPE)range: < 11.0.26-1.1
- (no CPE)range: < 10.1.60-160000.1.1
- (no CPE)range: < 2.0.16-160000.1.1
- (no CPE)range: >= 8.5.88, < 9.0.45
- (no CPE)range: < 1.3.9-160000.1.1
- (no CPE)range: < 11.0.26-160000.1.1
- (no CPE)range: < 9.0.122-160000.1.1
Patches
Vulnerability mechanics
References
2News mentions
4- ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware ArrestsThe Hacker News · Oct 5, 2026
- Apache: 25 Vulnerabilities Disclosed, Critical Flaws Hit Tomcat on Sep 23-24, 2026Vypr Intelligence · Sep 24, 2026
- Apache Tomcat Update Fixes WebSocket and HTTP/2 Flaws Affecting Server SecurityCyber Security News · Sep 24, 2026
- Apache Tomcat: 12 Vulnerabilities Including HTTP/2 Smuggling and Auth Bypass Disclosed TogetherVypr Intelligence · Sep 23, 2026