cv.igrp:igrp-core (>=1.7.2.230613, <=1.8.3.240913), cv.igrp:igrp-core-war (>=1.7.2.230622, <=1.7.3.230802) +26 more potentially affected by CVE-2026-79677 via org.apache.tomcat:tomcat-websocket (>=9.0.5, <=9.0.121)

org.apache.tomcat:tomcat-websocket MAVEN version =9.0.5, =1.7.2.230613, =1.7.2.230622, =8.0.1, =8.0.5, =8.0.5, =8.0.5, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.16 and more Source cves: CVE-2026-79677 Source advisory: MEND:CVE-2026-79677...

CVE-2026-79677

Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through...

org.apache.tomee.bom:tomee-microprofile (>=10.0.0-m1, <=10.0.0), org.apache.tomee.bom:tomee-plume (>=10.0.0-m1, <=10.0.0) +13 more potentially affected by CVE-2026-79677 via org.apache.tomcat:tomcat-websocket (>=10.1.20, <=10.1.57)

org.apache.tomcat:tomcat-websocket MAVEN version =10.1.20, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.2.0 Source cves: CVE-2026-79677 Source advisory:...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +8667 more potentially affected by CVE-2026-79677 via org.apache.tomcat.embed:tomcat-embed-websocket (>=10.1.0-m16, <=10.1.59)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version =10.1.0-m16, =0.2.0, =0.0.4, =0.1.3, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-79677 Source advisory: MEND:CVE-2026-79677...

CVE-2026-77791 Apache Tomcat: DoS via busy wait during WebSocket close

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time...

EUVD-2026-85229

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time...

org.apache.tomee.bom:tomee-microprofile (>=10.0.0-m1, <=10.0.0), org.apache.tomee.bom:tomee-plume (>=10.0.0-m1, <=10.0.0) +13 more potentially affected by CVE-2026-77791 via org.apache.tomcat:tomcat-websocket (>=10.1.20, <=10.1.57)

org.apache.tomcat:tomcat-websocket MAVEN version =10.1.20, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.2.0 Source cves: CVE-2026-77791 Source advisory:...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +8379 more potentially affected by CVE-2026-77791 via org.apache.tomcat.embed:tomcat-embed-websocket (>=10.1.8, <=10.1.59)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version =10.1.8, =0.2.0, =0.0.4, =0.1.3, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-77791 Source advisory: MEND:CVE-2026-77791...

CVE-2026-77791 Apache Tomcat: DoS via busy wait during WebSocket close

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time...

ai.astraform:remote-domain-template-java-spring (>=0.2.0, <=0.4.4), ai.chatur:cortex-spring-boot-autoconfigure (>=0.0.1, <=0.1.4) +2975 more potentially affected by CVE-2026-77791 via org.apache.tomcat.embed:tomcat-embed-websocket (>=11.0.0-m15, <=11.0.25)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version =11.0.0-m15, =0.2.0, =0.0.1, =0.0.1, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.2.0 and more Source cves: CVE-2026-77791 Source advisory:...

ai.apiverse:apipulse (1.0.1), ai.chat2db.excel:easyexcel-plus-test (0.0.1) +3057 more potentially affected by CVE-2026-77791 via org.apache.tomcat.embed:tomcat-embed-websocket (>=9.0.74, <=9.0.121)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version =9.0.74, =6.2.2, =2.3.0, =2.3.0, =6.6.0, =6.6.0, =6.6.0, =6.10.5 - cc.chensoul.nacos:core-test 2.5.2 - cc.chensoul.nacos:nacos-address 2.5.2 - cc.chensoul.nacos:nacos-cmdb 2.5.2 and more Source cves: CVE-2026-77791 Source advisory:...

cv.igrp:igrp-core (>=1.7.3.230811, <=1.8.3.240913), org.apache.tomee.bom:tomee-microprofile (>=8.0.15, <=8.0.16) +22 more potentially affected by CVE-2026-77791 via org.apache.tomcat:tomcat-websocket (>=9.0.74, <=9.0.121)

org.apache.tomcat:tomcat-websocket MAVEN version =9.0.74, =1.7.3.230811, =8.0.15, =8.0.15, =8.0.15, =8.0.15, =8.0.15, =8.0.15, =8.0.15, =8.0.15, =8.0.15, =8.0.15, =8.0.15, =8.0.15, =8.0.15, =8.0.15, =8.0.16 and more Source cves: CVE-2026-77791 Source advisory: MEND:CVE-2026-77791...

io.github.t1willi:jolt (>=2.6.2, <=25.08.4), org.apache.tomee.bom:tomee-webprofile (11.0.0-m1) +15 more potentially affected by CVE-2026-77791 via org.apache.tomcat:tomcat-websocket (>=11.0.0-m20, <=11.0.25)

org.apache.tomcat:tomcat-websocket MAVEN version =11.0.0-m20, =2.6.2, =11.0.0, =11.1.3 and more Source cves: CVE-2026-77791 Source advisory: MEND:CVE-2026-77791...

CVE-2026-77791

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time...

CVE-2026-77791

Apache Tomcat is vulnerable to a Denial of Service (DoS) attack due to an uncontrolled resource consumption issue occurring during the sending of a WebSocket close message . The root cause is a busy wait condition that can be triggered by an attacker. This vulnerability affects versions 11.0.0-M5...

ai.astraform:remote-domain-template-java-spring (>=0.2.0, <=0.4.4), ai.chatur:cortex-spring-boot-autoconfigure (>=0.0.1, <=0.1.4) +2975 more potentially affected by CVE-2026-76183 via org.apache.tomcat.embed:tomcat-embed-websocket (>=11.0.0-m15, <=11.0.25)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version =11.0.0-m15, =0.2.0, =0.0.1, =0.0.1, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.2.0 and more Source cves: CVE-2026-76183 Source advisory:...

org.apache.tomee.bom:tomee-microprofile (>=10.0.0-m1, <=10.0.0), org.apache.tomee.bom:tomee-plume (>=10.0.0-m1, <=10.0.0) +13 more potentially affected by CVE-2026-76183 via org.apache.tomcat:tomcat-websocket (>=10.1.20, <=10.1.57)

org.apache.tomcat:tomcat-websocket MAVEN version =10.1.20, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.2.0 Source cves: CVE-2026-76183 Source advisory:...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +8667 more potentially affected by CVE-2026-76183 via org.apache.tomcat.embed:tomcat-embed-websocket (>=10.1.0-m16, <=10.1.59)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version =10.1.0-m16, =0.2.0, =0.0.4, =0.1.3, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-76183 Source advisory: MEND:CVE-2026-76183...

CVE-2026-76183 Apache Tomcat: Bypass of security constraints for WebSocket endpoints

Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following version...

CVE-2026-76183 Apache Tomcat: Bypass of security constraints for WebSocket endpoints

Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following version...