CVE-2026-87022

A flaw was found in Apache Tomcat. This vulnerability, related to improper handling of length parameters, allows for WebSocket message smuggling when the 'per-message-deflate' extension is in use. A remote attacker could exploit this to bypass security controls or inject malicious data into...

SUSE CVE-2026-87022

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...

Linux Distros Unpatched Vulnerability : CVE-2026-87022

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This iss...

UBUNTU-CVE-2026-87022

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...

CVE-2026-87022

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...

DEBIAN-CVE-2026-87022

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...

CVE-2026-87022

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...

CVE-2026-87022

Apache Tomcat is vulnerable to WebSocket message smuggling due to an improper handling of length parameter inconsistency when the per-message-deflate feature is enabled. This vulnerability affects versions 11.0.0-M1 through 11.0.25 , 10.1.0-M1 through 10.1.59 , and 9.0.0.M1 through 9.0.121 . Addi...

CVE-2026-87022 Apache Tomcat: WebSocket message smuggling with per-message-deflate

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...

EUVD-2026-85236

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...

CVE-2026-87022

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...

CVE-2026-87022 Apache Tomcat: WebSocket message smuggling with per-message-deflate

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...

CVE-2026-87022: Improper Handling of Length Parameter Inconsistency

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...

tomcat: Apache Tomcat: WebSocket message smuggling via improper length handling

A flaw was found in Apache Tomcat. This vulnerability, related to improper handling of length parameters, allows for WebSocket message smuggling when the 'per-message-deflate' extension is in use. A remote attacker could exploit this to bypass security controls or inject malicious data into...

tomcat: Apache Tomcat: WebSocket message smuggling via improper length handling

A flaw was found in Apache Tomcat. This vulnerability, related to improper handling of length parameters, allows for WebSocket message smuggling when the 'per-message-deflate' extension is in use. A remote attacker could exploit this to bypass security controls or inject malicious data into...

Fixed in Apache Tomcat 10.1.60

Low: WebSocket message smuggling with per-message-deflate CVE-2026-87022 Improper handling of length parameter allows WebSocket message smuggling when per-message-deflate is used. This was fixed with commit 567a8551. This issue was reported to the Tomcat security team on 7 September 2026. The iss...

Fixed in Apache Tomcat 11.0.26

Low: WebSocket message smuggling with per-message-deflate CVE-2026-87022 Improper handling of length parameter allows WebSocket message smuggling when per-message-deflate is used. This was fixed with commit 4fef25fe. This issue was reported to the Tomcat security team on 7 September 2026. The iss...

Fixed in Apache Tomcat 9.0.122

Low: WebSocket message smuggling with per-message-deflate CVE-2026-87022 Improper handling of length parameter allows WebSocket message smuggling when per-message-deflate is used. This was fixed with commit 959a52a2. This issue was reported to the Tomcat security team on 7 September 2026. The iss...

Linux Distros Unpatched Vulnerability : CVE-2026-45103

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the...

CVE-2026-45103

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Content-Length header using unsigned int arithmetic with no overflow check. When an attacker sends a Content-Length value that overflows unsigned...