PT-2026-82249

Name of the Vulnerable Software and Affected Versions Reactor Netty versions 1.3.0 through 1.3.6 Reactor Netty versions 1.1.0 through 1.2.18 Reactor Netty versions 1.0.52 and earlier Description The Reactor Netty WebSocket client may leak credentials during WebSocket handshake redirects to a...

Libevent WebSocket DoS

The vulnerability of the ws.c file of the WebSocket server in the Libevent library-related event notification asynchronous library is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

DEBIAN-CVE-2026-73180

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

CVE-2026-73180

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

CVE-2026-73180 Apache Tomcat: Authenticated WebSocket session survives end of HTTP session

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

CVE-2026-73180

Apache Tomcat is affected by an Insufficient Session Expiration vulnerability (CWE-613) where a WebSocket session remains open even after the underlying authenticated HTTP session ends, specifically if the session ID is changed. This occurs because the server fails to close the WebSocket connecti...

CVE-2026-73180 Apache Tomcat: Authenticated WebSocket session survives end of HTTP session

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

CVE-2026-73180 Apache Tomcat: Authenticated WebSocket session survives end of HTTP session

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

CVE-2026-73180

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

org.apache.tomee.bom:tomee-microprofile (>=10.0.0-m1, <=10.0.0), org.apache.tomee.bom:tomee-plume (>=10.0.0-m1, <=10.0.0) +13 more potentially affected by CVE-2026-73180 via org.apache.tomcat:tomcat-websocket (>=10.1.20, <=10.1.57)

org.apache.tomcat:tomcat-websocket MAVEN version =10.1.20, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.2.0 Source cves: CVE-2026-73180 Source advisory:...

cv.igrp:igrp-core (>=1.7.2.230613, <=1.8.3.240913), cv.igrp:igrp-core-war (>=1.7.2.230622, <=1.7.3.230802) +26 more potentially affected by CVE-2026-73180 via org.apache.tomcat:tomcat-websocket (>=9.0.5, <=9.0.120)

org.apache.tomcat:tomcat-websocket MAVEN version =9.0.5, =1.7.2.230613, =1.7.2.230622, =8.0.1, =8.0.5, =8.0.5, =8.0.5, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.16 and more Source cves: CVE-2026-73180 Source advisory: MEND:CVE-2026-73180...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.6.0.0), ai.apiverse:apipulse (1.0.1) +12910 more potentially affected by CVE-2026-73180 via org.apache.tomcat.embed:tomcat-embed-websocket (>=9.0.0.m18, <=9.0.120)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version =9.0.0.m18, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =1.4.2, =1.6.6, =j8.2.2.0, =j8.2.2.0, =2.1.0 and more Source cves: CVE-2026-73180 Source advisory: MEND:CVE-2026-73180...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +8674 more potentially affected by CVE-2026-73180 via org.apache.tomcat.embed:tomcat-embed-websocket (>=10.1.0-m16, <=10.1.57)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version =10.1.0-m16, =0.2.0, =0.0.4, =0.1.3, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-73180 Source advisory: MEND:CVE-2026-73180...

ai.astraform:remote-domain-template-java-spring (>=0.2.0, <=0.4.4), ai.chatur:cortex-spring-boot-autoconfigure (>=0.0.1, <=0.1.4) +2975 more potentially affected by CVE-2026-73180 via org.apache.tomcat.embed:tomcat-embed-websocket (>=11.0.0-m15, <=11.0.24)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version =11.0.0-m15, =0.2.0, =0.0.1, =0.0.1, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.2.0 and more Source cves: CVE-2026-73180 Source advisory:...

io.github.t1willi:jolt (>=2.6.2, <=25.08.4), org.apache.tomee.bom:tomee-webprofile (11.0.0-m1) +15 more potentially affected by CVE-2026-73180 via org.apache.tomcat:tomcat-websocket (>=11.0.0-m20, <=11.0.24)

org.apache.tomcat:tomcat-websocket MAVEN version =11.0.0-m20, =2.6.2, =11.0.0, =11.1.3 and more Source cves: CVE-2026-73180 Source advisory: MEND:CVE-2026-73180...

CVE-2026-73180

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

GO-2026-6271 Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689) in github.com/axllent/mailpit

Mailpit: WebSocket origin check bypass via percent-encoded path regression of CVE-2026-22689 in github.com/axllent/mailpit...

GO-2026-6286 Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channel in github.com/mattermost/mattermost-server

Mattermost doesn't restrict roleupdated websocket event broadcasts to members of the affected team or channel in github.com/mattermost/mattermost-server...

EUVD-2026-45030

Whistle vulnerable to path traversal...

CVE-2026-55571

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to 1.0.4, LiveViewConsumer.handlemount sends a "type":"navigate","to":... frame when loginrequired, permissionrequired, or a redirecting onmount hook denies a LiveView mount, but...