Executive brief
Apache Tomcat is a widely-used Java web server that handles both HTTP sessions and real-time WebSocket connections. A vulnerability causes WebSocket connections to persist even after their underlying HTTP session has ended, if the session ID was changed during the WebSocket connection. This allows an attacker with access to an old WebSocket connection to continue sending and receiving messages after the user has logged out, potentially gaining unauthorized access to application features or data.
Technical details
The vulnerability is an insufficient session expiration flaw in Apache Tomcat's WebSocket implementation. When an authenticated HTTP session's ID is changed (e.g., during security-sensitive operations), the corresponding WebSocket connection is not properly closed as mandated by the Jakarta WebSocket specification. An attacker who maintains a WebSocket connection from an authenticated session can continue using that connection even after the HTTP session ends, bypassing session termination logic. The vulnerability affects multiple versions across Tomcat 7.x, 8.5.x, 9.x, 10.1.x, and 11.x branches. Patches are available in Tomcat 11.0.25, 10.1.58, and 9.0.121.
Affected products
- Apache Tomcat 7.0.43 through 7.0.109, 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.120, 10.1.0-M1 through 10.1.57, 11.0.0-M1 through 11.0.24
Timeline
- 2026-08-25: disclosed: CVE-2026-73180 published
- 2026-08-25: patched: Fixed in Tomcat 11.0.25, 10.1.58, 9.0.121