Security Bulletin: Apache Tomcat (tomcat-embed-websocket) — Insufficient Session Expiration via WebSocket

Summary tomcat-embed-websocket-10.1.57.jar detected by Mend scanner in db2-service-java/pom.xml. The affected version 10.1.57 is vulnerable to CVE-2026-73180 where a WebSocket session is not closed when the associated HTTP session ends after a session ID change, violating the Jakarta WebSocket...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration due to the improper termination of WebSocket sessions when the associated HTTP session ends. An attacker can maintain access to resources beyond the intended session duration by establishing a WebSocket...

ROOT-APP-MAVEN-CVE-2024-23672 CVE-2024-23672 in io.root.org.apache.tomcat.embed:tomcat-embed-websocket - Patched by Root

Root has patched CVE-2024-23672 in the io.root.org.apache.tomcat.embed:tomcat-embed-websocket package for Root:Maven. Multiple fixed versions available...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in tomcat-embed-websocket-9.0.83.jar

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in tomcat-embed-websocket-9.0.83.jar Vulnerability Details CVEID:CVE-2024-23672 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by an incomplete cleanup flaw. By sending specially crafted...