org.apache.tomee.bom:tomee-microprofile (>=10.0.0-m1, <=10.0.0), org.apache.tomee.bom:tomee-plume (>=10.0.0-m1, <=10.0.0) +13 more potentially affected by CVE-2026-77791 via org.apache.tomcat:tomcat-websocket (>=10.1.20, <=10.1.57)

org.apache.tomcat:tomcat-websocket MAVEN version =10.1.20, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.2.0 Source cves: CVE-2026-77791 Source advisory:...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +8386 more potentially affected by CVE-2026-77791 via org.apache.tomcat.embed:tomcat-embed-websocket (>=10.1.8, <=10.1.57)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version =10.1.8, =0.2.0, =0.0.4, =0.1.3, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-77791 Source advisory:...

ai.astraform:remote-domain-template-java-spring (>=0.2.0, <=0.4.4), ai.chatur:cortex-spring-boot-autoconfigure (>=0.0.1, <=0.1.4) +2975 more potentially affected by CVE-2026-77791 via org.apache.tomcat.embed:tomcat-embed-websocket (>=11.0.0-m15, <=11.0.24)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version =11.0.0-m15, =0.2.0, =0.0.1, =0.0.1, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.2.0 and more Source cves: CVE-2026-77791 Source advisory:...

cv.igrp:igrp-core (>=1.7.3.230811, <=1.8.3.240913), org.apache.tomee.bom:tomee-microprofile (>=8.0.15, <=8.0.16) +22 more potentially affected by CVE-2026-77791 via org.apache.tomcat:tomcat-websocket (>=9.0.74, <=9.0.120)

org.apache.tomcat:tomcat-websocket MAVEN version =9.0.74, =1.7.3.230811, =8.0.15, =8.0.15, =8.0.15, =8.0.15, =8.0.15, =8.0.15, =8.0.15, =8.0.15, =8.0.15, =8.0.15, =8.0.15, =8.0.15, =8.0.15, =8.0.15, =8.0.16 and more Source cves: CVE-2026-77791 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-21249758...

ai.apiverse:apipulse (1.0.1), ai.chat2db.excel:easyexcel-plus-test (0.0.1) +3087 more potentially affected by CVE-2026-77791 via org.apache.tomcat.embed:tomcat-embed-websocket (>=9.0.74, <=9.0.120)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version =9.0.74, =6.2.2, =2.3.0, =2.3.0, =6.6.0, =6.6.0, =6.6.0, =6.10.5 - cc.chensoul.nacos:core-test 2.5.2 - cc.chensoul.nacos:nacos-address 2.5.2 - cc.chensoul.nacos:nacos-cmdb 2.5.2 and more Source cves: CVE-2026-77791 Source advisory:...

io.github.t1willi:jolt (>=2.6.2, <=25.08.4), org.apache.tomee.bom:tomee-webprofile (11.0.0-m1) +15 more potentially affected by CVE-2026-77791 via org.apache.tomcat:tomcat-websocket (>=11.0.0-m20, <=11.0.24)

org.apache.tomcat:tomcat-websocket MAVEN version =11.0.0-m20, =2.6.2, =11.0.0, =11.1.3 and more Source cves: CVE-2026-77791 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-21249758...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via busy wait during WebSocket close. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users. Unlike other vulnerabilities, DoS...

Denial of Service (DoS)

Overview org.apache.tomcat:tomcat-websocket is a Tomcat WebSocket JSR356 implementation. Affected versions of this package are vulnerable to Denial of Service DoS via busy wait during WebSocket close. Details Denial of Service DoS describes a family of attacks, all aimed at making a system...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.6.0.0), ai.apiverse:apipulse (1.0.1) +12910 more potentially affected by CVE-2026-79677 via org.apache.tomcat.embed:tomcat-embed-websocket (>=9.0.0.m18, <=9.0.121)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version =9.0.0.m18, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =1.4.2, =1.6.6, =j8.2.2.0, =j8.2.2.0, =2.1.0 and more Source cves: CVE-2026-79677 Source advisory: SNYK:JAVA-ORGAPACHETOMCATEMBED-21246252...

ai.astraform:remote-domain-template-java-spring (>=0.2.0, <=0.4.4), ai.chatur:cortex-spring-boot-autoconfigure (>=0.0.1, <=0.1.4) +2995 more potentially affected by CVE-2026-79677 via org.apache.tomcat.embed:tomcat-embed-websocket (>=11.0.0-m15, <=11.0.25)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version =11.0.0-m15, =0.2.0, =0.0.1, =0.0.1, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.2.0 and more Source cves: CVE-2026-79677 Source advisory:...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +8684 more potentially affected by CVE-2026-79677 via org.apache.tomcat.embed:tomcat-embed-websocket (>=10.1.0-m16, <=10.1.59)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version =10.1.0-m16, =0.2.0, =0.0.4, =0.1.3, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-79677 Source advisory:...

org.apache.tomee.bom:tomee-microprofile (>=10.0.0-m1, <=10.0.0), org.apache.tomee.bom:tomee-plume (>=10.0.0-m1, <=10.0.0) +13 more potentially affected by CVE-2026-79677 via org.apache.tomcat:tomcat-websocket (>=10.1.20, <=10.1.57)

org.apache.tomcat:tomcat-websocket MAVEN version =10.1.20, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.2.0 Source cves: CVE-2026-79677 Source advisory:...

cv.igrp:igrp-core (>=1.7.2.230613, <=1.8.3.240913), cv.igrp:igrp-core-war (>=1.7.2.230622, <=1.7.3.230802) +26 more potentially affected by CVE-2026-79677 via org.apache.tomcat:tomcat-websocket (>=9.0.5, <=9.0.121)

org.apache.tomcat:tomcat-websocket MAVEN version =9.0.5, =1.7.2.230613, =1.7.2.230622, =8.0.1, =8.0.5, =8.0.5, =8.0.5, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.16 and more Source cves: CVE-2026-79677 Source advisory:...

Missing Release of Resource after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime through the WebSocket write timeout handling in org.apache.tomcat.websocket.WsRemoteEndpointImplBase, WsRemoteEndpointImplClient, WsRemoteEndpointImplServer, and MessagePart. An...

Missing Release of Resource after Effective Lifetime

Overview org.apache.tomcat:tomcat-websocket is a Tomcat WebSocket JSR356 implementation. Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime through the WebSocket write timeout handling in org.apache.tomcat.websocket.WsRemoteEndpointImplBase,...

io.github.t1willi:jolt (>=2.6.2, <=25.08.4), org.apache.tomee.bom:tomee-webprofile (11.0.0-m1) +15 more potentially affected by CVE-2026-79677 via org.apache.tomcat:tomcat-websocket (>=11.0.0-m20, <=11.0.25)

org.apache.tomcat:tomcat-websocket MAVEN version =11.0.0-m20, =2.6.2, =11.0.0, =11.1.3 and more Source cves: CVE-2026-79677 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-21246251...

CVE-2026-83599

A flaw was found in Netdata. An unauthenticated remote attacker can exploit a vulnerability in the WebSocket server's decompression mechanism. By sending small, highly compressed messages, the attacker can cause the server to allocate excessive amounts of memory. This can lead to the exhaustion o...

CVE-2026-87022

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...

org.apache.tomee.bom:tomee-microprofile (>=10.0.0-m1, <=10.0.0), org.apache.tomee.bom:tomee-plume (>=10.0.0-m1, <=10.0.0) +13 more potentially affected by CVE-2026-87022 via org.apache.tomcat:tomcat-websocket (>=10.1.20, <=10.1.57)

org.apache.tomcat:tomcat-websocket MAVEN version =10.1.20, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.2.0 Source cves: CVE-2026-87022 Source advisory:...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.6.0.0), ai.apiverse:apipulse (1.0.1) +12910 more potentially affected by CVE-2026-87022 via org.apache.tomcat.embed:tomcat-embed-websocket (>=9.0.0.m18, <=9.0.121)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version =9.0.0.m18, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =1.4.2, =1.6.6, =j8.2.2.0, =j8.2.2.0, =2.1.0 and more Source cves: CVE-2026-87022 Source advisory: MEND:CVE-2026-87022...