CVE-2026-66299 Overview
CVE-2026-66299 is an Uncontrolled Resource Consumption vulnerability [CWE-400] in the WebSocket chat example bundled with Apache Tomcat. Remote, unauthenticated attackers can trigger resource exhaustion through the example application, leading to denial of service against the server. The flaw affects Apache Tomcat versions 11.0.0-M20 through 11.0.24, 10.1.24 through 10.1.57, and 9.0.89 through 9.0.120. Deployments that followed Apache's security guidance to remove the examples web application from production installations are not affected.
Critical Impact
Unauthenticated network attackers can exhaust server resources via the WebSocket chat example, causing high-availability impact on affected Apache Tomcat instances.
Affected Products
- Apache Tomcat 11.0.0-M20 through 11.0.24
- Apache Tomcat 10.1.24 through 10.1.57
- Apache Tomcat 9.0.89 through 9.0.120
Discovery Timeline
- 2026-07-28 - CVE-2026-66299 published to NVD
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-66299
Vulnerability Analysis
The vulnerability resides in the WebSocket chat example application shipped with Apache Tomcat. The example does not enforce adequate limits on resources consumed per connection or per client. Remote attackers can open WebSocket sessions to the chat endpoint and drive the server into a resource-exhaustion state. The impact is confined to availability. Confidentiality and integrity are not affected, according to the published CVSS vector.
The attack requires no authentication, no user interaction, and can be performed over the network against any Tomcat instance that still exposes the examples web application. Because the examples context is disabled or removed on hardened deployments, the practical exposure is limited to installations that retained default sample applications.
Root Cause
The root cause is missing resource-consumption controls within the demonstration WebSocket chat handler. The example was designed as instructional code and does not include the throttling, connection limits, or message-rate enforcement expected in production WebSocket endpoints. This aligns with the [CWE-400] Uncontrolled Resource Consumption weakness class.
Attack Vector
An attacker sends WebSocket traffic to the vulnerable chat endpoint under the examples web application context. Sustained or high-volume interactions exhaust server-side resources such as memory or threads. The vulnerability manifests only when the examples application is deployed. Refer to the Apache Mailing List Thread and Openwall OSS-Security Discussion for technical detail.
Detection Methods for CVE-2026-66299
Indicators of Compromise
- Presence of the examples web application (typically under /examples/) on production Apache Tomcat instances.
- Unusual WebSocket upgrade requests targeting /examples/websocket/chat or similar example endpoints.
- Sustained spikes in Tomcat thread count, heap usage, or open socket counts without a matching increase in legitimate application traffic.
Detection Strategies
- Inventory Tomcat installations and flag any host still deploying the examples context on internet-facing or shared infrastructure.
- Alert on repeated WebSocket connections from a single source IP to example paths, particularly high-frequency message rates.
- Correlate JVM resource metrics (heap, threads, file descriptors) with WebSocket session counts to identify exhaustion patterns.
Monitoring Recommendations
- Enable Tomcat access logs for WebSocket upgrade requests and forward them to a centralized log platform.
- Monitor JMX metrics for ThreadPool saturation and Manager session growth on the Catalina engine.
- Configure web application firewall rules to detect and rate-limit anomalous WebSocket traffic patterns targeting example contexts.
How to Mitigate CVE-2026-66299
Immediate Actions Required
- Remove the examples web application from all production Apache Tomcat servers, in line with Apache's long-standing hardening guidance.
- Upgrade to Apache Tomcat 11.0.25, 10.1.58, or 9.0.121 when released to obtain the fix.
- Audit reverse-proxy and firewall rules to ensure example contexts are not reachable from untrusted networks.
Patch Information
Apache recommends upgrading to Apache Tomcat 11.0.25, 10.1.58, or 9.0.121 (when released), which remediate the resource-consumption flaw in the WebSocket chat example. Users who have already removed the examples web application are not affected and require no code change. See the Apache Mailing List Thread for the vendor announcement.
Workarounds
- Delete the $CATALINA_BASE/webapps/examples directory and remove any deployment descriptor entries referencing the examples context.
- Restrict access to the examples context through RemoteAddrValve or upstream network controls if removal is not immediately possible.
- Apply WebSocket connection and message rate limits at a reverse proxy in front of Tomcat until the upgrade is deployed.
# Remove the examples web application from a Tomcat installation
sudo systemctl stop tomcat
sudo rm -rf "$CATALINA_BASE/webapps/examples"
sudo rm -rf "$CATALINA_BASE/work/Catalina/localhost/examples"
sudo systemctl start tomcat
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
