Fixed in Apache Tomcat 9.0.121

🗓️ 18 Aug 2026 00:00:00Reported by Apache TomcatType

Tomcat 9.0.121 fixes DoS in WebSocket chat example caused by unbounded buffer from slow clients.

Reporter	Title	Published	Views	Family All 897
IBM Security Bulletins	Security Bulletin: IBM ApplinX is vulnerable to multiple issues like improper Access control, Authentication Bypass, Improper Authorization and more due to the use of Apache-Tomcat .	22 Sep 202612:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway for Multiplatforms.	9 Sep 202609:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) affected by an Uncontrolled Resource Consumption Vulnerability in Apache Tomcat (CVE-2026-68763)	15 Oct 202619:32	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	5 Oct 202608:14	–	ibm
IBM Security Bulletins	Security Bulletin: DEV-EXT - tomcat-embed-core-10.1.57.jar (Publicly disclosed vulnerability found by Scanner)	17 Sep 202620:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities	28 Sep 202606:43	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Tomcat (tomcat-embed-websocket) ‚Äî Insufficient Session Expiration via WebSocket	17 Sep 202620:19	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been identified in third party libraries shipped with IBM Guardium Cryptography Manager (GCM)	14 Oct 202606:16	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	1 Oct 202610:16	–	ibm
attackerkb	CVE-2026-66299	28 Jul 202614:29	–	attackerkb