tomcat: Apache Tomcat: Denial of Service via WebSocket chat example

A flaw was found in Apache Tomcat. This uncontrolled resource consumption vulnerability, located in the WebSocket chat example, allows a remote attacker to cause a Denial of Service DoS by exhausting system resources. This can lead to the affected system becoming unresponsive or crashing...

tomcat: Apache Tomcat: Authenticated WebSocket session persists after HTTP session termination

A flaw was found in Apache Tomcat. This vulnerability, categorized as Insufficient Session Expiration, occurs when an authenticated HTTP session's ID is modified after a WebSocket connection has been established. Under these conditions, the WebSocket session fails to terminate as expected when th...

EUVD-2026-60539

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fails to validate WebSocket command field types which allows an authenticated user to crash the plugin process and deny service to all Boards users via a customfocalboardSUBSCRIBETEAM message with a non-string teamId...

CVE-2026-50161: Integer Overflow or Wraparound

libre is a generic library for real-time communications with asynchronous input and output support. Prior to 4.8.1, the websockdecode function in src/websock/websock.c contains an integer overflow when validating a masked WebSocket frame that uses the 64-bit extended length encoding. The expressi...

Linux Distros Unpatched Vulnerability : CVE-2026-61666

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server passes a malformed Host header to URI.parse in...

Fixed in Apache Tomcat 9.0.121

Low: Authenticated WebSocket session survives end of HTTP session CVE-2026-73180 If the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the...

Fixed in Apache Tomcat 11.0.25

Low: Authenticated WebSocket session survives end of HTTP session CVE-2026-73180 If the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the...

CVE-2026-10080

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fails to validate WebSocket command field types which allows an authenticated user to crash the plugin process and deny service to all Boards users via a customfocalboardSUBSCRIBETEAM message with a non-string teamId...

CVE-2026-10080

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fails to validate WebSocket command field types which allows an authenticated user to crash the plugin process and deny service to all Boards users via a customfocalboardSUBSCRIBETEAM message with a non-string teamId...

CVE-2026-10080 Boards plugin panics on WebSocket command with non-string field types

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fails to validate WebSocket command field types which allows an authenticated user to crash the plugin process and deny service to all Boards users via a customfocalboardSUBSCRIBETEAM message with a non-string teamId...

CVE-2026-10080 Boards plugin panics on WebSocket command with non-string field types

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fails to validate WebSocket command field types which allows an authenticated user to crash the plugin process and deny service to all Boards users via a customfocalboardSUBSCRIBETEAM message with a non-string teamId...

CVE-2026-10080 Boards plugin panics on WebSocket command with non-string field types

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fails to validate WebSocket command field types which allows an authenticated user to crash the plugin process and deny service to all Boards users via a customfocalboardSUBSCRIBETEAM message with a non-string teamId...

CVE-2026-10080

Mattermost Boards plugin panics on WebSocket custom_focalboard_SUBSCRIBE_TEAM messages with a non-string teamId, crashing the plugin and denying service to all Boards users. Affected: 11.7.x ≤ 11.7.6, 10.11.x ≤ 10.11.21, 11.8.x ≤ 11.8.3 (MMSA-2026-00687). No in-the-wild exploitation reported. Pat...

CVE-2026-73565

A flaw was found in @hono/node-server. An unauthenticated attacker can exploit this vulnerability by sending a WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header. This action causes the server to retain request data, leading to unbounded memory growth and eventually a...

org.http4k:http4k-aws (3.21.2), org.http4k:http4k-client-apache (3.21.2) +24 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.21.2)

org.http4k:http4k-core MAVEN version 3.21.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.21.2 - org.http4k:http4k-client-apache 3.21.2 - org.http4k:http4k-client-apache-async 3.21...

org.http4k:http4k-aws (3.21.1), org.http4k:http4k-client-apache (3.21.1) +24 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.21.1)

org.http4k:http4k-core MAVEN version 3.21.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.21.1 - org.http4k:http4k-client-apache 3.21.1 - org.http4k:http4k-client-apache-async 3.21...

org.http4k:http4k-aws (3.20.0), org.http4k:http4k-client-apache (3.20.0) +24 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.20.0)

org.http4k:http4k-core MAVEN version 3.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.20.0 - org.http4k:http4k-client-apache 3.20.0 - org.http4k:http4k-client-apache-async 3.20...

org.http4k:http4k-aws (3.16.0), org.http4k:http4k-client-apache (3.16.0) +23 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.16.0)

org.http4k:http4k-core MAVEN version 3.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.16.0 - org.http4k:http4k-client-apache 3.16.0 - org.http4k:http4k-client-apache-async 3.16...

org.http4k:http4k-aws (3.15.0), org.http4k:http4k-client-apache (3.15.0) +23 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.15.0)

org.http4k:http4k-core MAVEN version 3.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.15.0 - org.http4k:http4k-client-apache 3.15.0 - org.http4k:http4k-client-apache-async 3.15...

org.http4k:http4k-aws (3.31.0), org.http4k:http4k-client-apache (3.31.0) +25 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.31.0)

org.http4k:http4k-core MAVEN version 3.31.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.31.0 - org.http4k:http4k-client-apache 3.31.0 - org.http4k:http4k-client-apache-async 3.31...