Fixed in Apache Tomcat 10.1.58

Low: DoS in WebSocket chat example CVE-2026-66299 The WebSocket chat example provided an unbounded buffer for undelivered messages. A maliciously slow client could cause the buffer to grow continuously, eventually leading to an memory exhaustion and failure of the Tomcat process. This was fixed...

CVE-2026-66299 Apache Tomcat: DoS via WebSocket chat example

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...

CVE-2026-66299

Apache Tomcat is vulnerable to an uncontrolled resource consumption vulnerability within its WebSocket chat example . This issue impacts versions 11.0.0-M20 through 11.0.24 , 10.1.24 through 10.1.57 , and 9.0.89 through 9.0.120 . The vulnerability can lead to a Denial of Service (DoS) . Users who...

CVE-2026-66299

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...

MAL-2026-11122 Malicious code in @crbrc/xbt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 179d74e089794cb517fcb4030021310137bedcc72f0ef49362b4ce1724cb5ac3 dist/index.js contains a startControlClient routine that reads OxaPay payment-gateway secrets OXAPAYGENERALAPIKEY, OXAPAYMERCHANTAPIKEY,...

Workerman Websocket Detection

Detects Workerman Websocket Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Workerman Websocket Detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Workerman Websocket Detection', 'description'...

Switching Protocol Detection

Detects Switching Protocol Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Switching Protocol Detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Switching Protocol Detection', 'description':...

resterm v0.48.1

Resterm A terminal-native API client and workbench for REST, GraphQL, gRPC, WebSocket and SSE. Resterm is an API-as-code workbench - or, in more familiar terms, an API client - built around plain .http and .rest files that you can diff, review and version. It combines interactive request editing...

CVE-2026-66299: Uncontrolled Resource Consumption

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...

CVE-2026-66299: Uncontrolled Resource Consumption

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...

PT-2026-65495

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M20 through 11.0.24 Apache Tomcat versions 10.1.24 through 10.1.57 Apache Tomcat versions 9.0.89 through 9.0.120 Description An uncontrolled resource consumption issue exists in the WebSocket chat example. The...

GridFsProducer Component Apache Camel Heap Buffer Overflow DoS

The vulnerability of the GridFsProducer class in the camel-mongodb-gridfs component, as well as the camel-atmosphere-websocket framework from the Apache Camel project, is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to gain access to read...

mailpit -- WebSocket origin check bypass via percent-encoded path

Mailpit author reports: The cross-site WebSocket hijacking fix was reimplemented as an origin check gated on a raw-URI prefix test, but Go's ServeMux routes on the percent-decoded path, so requesting /%61pi/events reaches the WebSocket handler while skipping the only origin control, and the...

Apache Tomcat 11.0.0.M1 < 11.0.25 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 11.0.25. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat11.0.25security-11 advisory. - Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This iss...

Apache Tomcat 9.0.0.M1 < 9.0.121 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 9.0.121. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat9.0.121security-9 advisory. - Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issu...

Malicious code in ulid-xyz (npm)

ulid-xyz is a typosquat of the popular ulid library sortable unique IDs and is a cross-platform Remote Access Trojan delivered via a postinstall hook. The package.json postinstall superficially looks like an inline node -e guard that checks for the existence of a dist file, but it actually launch...

Malicious code in forge-jsx4 (npm)

forge-jsx4 is a remote access trojan RAT published to the public npm registry by the account rafaelsilva [email protected]. Versions 1.0.122 and 1.0.123 were published on June 21-22, 2026 as a reconstitution of the forge-jsx / forge-jsxy campaign, reusing the same command-and-control...

Malicious code in @sheltr_/agent (npm)

Source: amazon-inspector 0ecc4dcd6d76f100601f8b37a6b9c3aab899770ab361f2714f9193a2f8d0db78 When the package's bin entry is run, it spawns an interactive PTY shell using $SHELL with the user's full process environment and HOME as the working directory, then opens a WebSocket connection to a hardcod...

Malicious code in sakuraai (npm)

Source: amazon-inspector d0910c3572d73bd98775851cb79032ba00dbceda2de969b25f04a7a7d1ddfe4e When the daemon is started e.g. via sakura daemon start, the package binds an HTTP+WebSocket server on 0.0.0.0 and additionally exposes it via a Tailscale sidecar. The WebSocket handler spawns an interactive...

Malicious code in vanexa-agent (npm)

Source: amazon-inspector 433bc5b1e6814e9c9a1f5d4ff26e2dbb31fdb8a5e9a08f9c94696347dcbeb803 When the daemon is started vanexa-agent start, it opens a WebSocket to the hardcoded relay wss://vanexa-agent-relay.hanazaki542.workers.dev/ws/daemon/ and dispatches incoming taskrequest messages into an...