AlmaLinux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.6:CLSA-2026:1788514837)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788514837 advisory. - Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed...

Security Bulletin: Apache Tomcat (tomcat-embed-websocket) — Insufficient Session Expiration via WebSocket

Summary tomcat-embed-websocket-10.1.57.jar detected by Mend scanner in db2-service-java/pom.xml. The affected version 10.1.57 is vulnerable to CVE-2026-73180 where a WebSocket session is not closed when the associated HTTP session ends after a session ID change, violating the Jakarta WebSocket...

Astra Linux – Vulnerability in Tomcat9

There is a vulnerability related to insufficient session expiration in Apache Tomcat. This vulnerability means that if the session ID of an authenticated HTTP session is changed after a WebSocket connection is established under that authenticated HTTP session, the WebSocket session will not be...

BIT-TOMCAT-2026-73180 Apache Tomcat: Authenticated WebSocket session survives end of HTTP session

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

DEBIAN-CVE-2026-73180

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

CVE-2026-73180 Apache Tomcat: Authenticated WebSocket session survives end of HTTP session

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

CVE-2026-73180 Apache Tomcat: Authenticated WebSocket session survives end of HTTP session

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

CVE-2026-73180

Apache Tomcat is affected by an Insufficient Session Expiration vulnerability (CWE-613) where a WebSocket session remains open even after the underlying authenticated HTTP session ends, specifically if the session ID is changed. This occurs because the server fails to close the WebSocket connecti...

CVE-2026-73180: Insufficient Session Expiration

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

PT-2026-81891

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.0.M1 through 9.0.120 Apache Tomcat versions 8.5.0 through 8.5.100 Apache Tomcat versions 7.0.43 through 7.0.109...