CVE-2026-73180 Apache Tomcat: Authenticated WebSocket session survives end of HTTP session

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

CVE-2026-73180

CVE-2026-73180 is an insufficient session expiration vulnerability in Apache Tomcat . When the session ID of an authenticated HTTP session is changed after a WebSocket connection has been established under that session, the WebSocket session is not closed as required by the Jakarta WebSocket spec...