Fixed in Apache Tomcat 9.0.121

Low: DoS in WebSocket chat example CVE-2026-66299 The WebSocket chat example provided an unbounded buffer for undelivered messages. A maliciously slow client could cause the buffer to grow continuously, eventually leading to an memory exhaustion and failure of the Tomcat process. This was fixed...