Is CVE-2026-73180 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73180 being exploited in the wild.

How severe is CVE-2026-73180?

Medium severity, with a CVSS score of 6.8, published 25 August 2026.

Which products and versions are affected?

Apache Tomcat 7.0.43 through 7.0.109, 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.120, 10.1.0-M1 through 10.1.57, 11.0.0-M1 through 11.0.24.

Is there a fix for CVE-2026-73180?

A patch was published on 2026-08-25: Fixed in Tomcat 11.0.25, 10.1.58, 9.0.121 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73180 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-73180?

Check whether you run Apache Tomcat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73180: Apache Tomcat WebSocket session lifetime violation

CVE-2026-73180 · Severity: medium · CVSS 6.8 · Published 2026-08-25

Apache Tomcat is a widely-used Java web server that handles both HTTP sessions and real-time WebSocket connections. A vulnerability causes WebSocket connections to persist even after their underlying HTTP session has ended, if the session ID was changed during the WebSocket connection. This allows an attacker with access to an old WebSocket connection to continue sending and receiving messages after the user has logged out, potentially gaining unauthorized access to application features or data.

Technologies: Apache Tomcat. Vendors: Apache.

Quick answers

Is CVE-2026-73180 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73180 being exploited in the wild.
How severe is CVE-2026-73180?: Medium severity, with a CVSS score of 6.8, published 25 August 2026.
Which products and versions are affected?: Apache Tomcat 7.0.43 through 7.0.109, 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.120, 10.1.0-M1 through 10.1.57, 11.0.0-M1 through 11.0.24.
Is there a fix for CVE-2026-73180?: A patch was published on 2026-08-25: Fixed in Tomcat 11.0.25, 10.1.58, 9.0.121 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73180 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-73180?: Check whether you run Apache Tomcat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an insufficient session expiration flaw in Apache Tomcat's WebSocket implementation. When an authenticated HTTP session's ID is changed (e.g., during security-sensitive operations), the corresponding WebSocket connection is not properly closed as mandated by the Jakarta WebSocket specification. An attacker who maintains a WebSocket connection from an authenticated session can continue using that connection even after the HTTP session ends, bypassing session termination logic. The vulnerability affects multiple versions across Tomcat 7.x, 8.5.x, 9.x, 10.1.x, and 11.x branches. Patches are available in Tomcat 11.0.25, 10.1.58, and 9.0.121.

Affected products

Apache Tomcat 7.0.43 through 7.0.109, 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.120, 10.1.0-M1 through 10.1.57, 11.0.0-M1 through 11.0.24

Timeline

2026-08-25: disclosed: CVE-2026-73180 published
2026-08-25: patched: Fixed in Tomcat 11.0.25, 10.1.58, 9.0.121

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.