Is CVE-2026-77791 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77791 being exploited in the wild.

How severe is CVE-2026-77791?

High severity, with a CVSS score of 7.5, published 23 September 2026.

Which products and versions are affected?

Apache Tomcat 11.0.0-M5 through 11.0.25, 10.1.8 through 10.1.59, 9.0.74 through 9.0.121, 8.5.88 through 8.5.100.

Is there a fix for CVE-2026-77791?

A patch was published on 2026-09-23: Fixed in Tomcat 11.0.26, 10.1.60, and 9.0.122 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77791 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-77791?

Check whether you run Apache Tomcat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77791: Apache Tomcat denial of service in WebSocket close message handling

CVE-2026-77791 · Severity: high · CVSS 7.5 · Published 2026-09-23

Apache Tomcat is a widely-used web server that handles HTTP requests and WebSocket connections for many business applications. A flaw in how Tomcat closes WebSocket connections allows an attacker to trigger a resource-exhaustion denial of service attack, potentially disrupting access to web applications that rely on WebSocket functionality.

Technologies: Apache Tomcat. Vendors: Apache.

Quick answers

Is CVE-2026-77791 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77791 being exploited in the wild.
How severe is CVE-2026-77791?: High severity, with a CVSS score of 7.5, published 23 September 2026.
Which products and versions are affected?: Apache Tomcat 11.0.0-M5 through 11.0.25, 10.1.8 through 10.1.59, 9.0.74 through 9.0.121, 8.5.88 through 8.5.100.
Is there a fix for CVE-2026-77791?: A patch was published on 2026-09-23: Fixed in Tomcat 11.0.26, 10.1.60, and 9.0.122 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77791 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-77791?: Check whether you run Apache Tomcat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An uncontrolled resource consumption vulnerability exists in the WebSocket close message handling code path, enabling a denial of service through busy-wait behavior. The attack is network-accessible and requires no authentication; an attacker can send crafted WebSocket close messages to exhaust CPU or other resources. The vendor has released patched versions to address this issue.

Affected products

Apache Tomcat 11.0.0-M5 through 11.0.25, 10.1.8 through 10.1.59, 9.0.74 through 9.0.121, 8.5.88 through 8.5.100

Timeline

2026-09-23: disclosed
2026-09-23: patched: Fixed in Tomcat 11.0.26, 10.1.60, and 9.0.122

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.