Executive brief
Apache Tomcat includes an optional 'examples' web application that contains a WebSocket chat demonstration. A flaw in this specific example allows an attacker to consume excessive server resources, potentially leading to a denial of service where the server becomes slow or unresponsive. This only affects organizations that have left the default example applications installed on their production or publicly accessible servers.
Technical details
An uncontrolled resource consumption vulnerability (CWE-400) exists within the WebSocket chat example included with Apache Tomcat. The flaw allows a remote attacker to trigger excessive resource usage by interacting with the vulnerable example component. This issue affects Tomcat versions 11.0.0-M20 through 11.0.24, 10.1.24 through 10.1.57, and 9.0.89 through 9.0.120. The vulnerability is limited to the 'examples' web application; systems where this application has been removed according to standard security hardening practices are not at risk. Patches are available in versions 11.0.25, 10.1.58, and 9.0.121.
Affected products
- Apache Tomcat 11.0.0-M20 to 11.0.24, 10.1.24 to 10.1.57, 9.0.89 to 9.0.120
Timeline
- 2026-07-28: disclosed
- 2026-07-28: advisory