CVE-2026-77791 Overview
CVE-2026-77791 is an Uncontrolled Resource Consumption vulnerability [CWE-400] in Apache Tomcat. The flaw resides in the WebSocket close message handling path and enables a remote denial of service (DoS) attack. An unauthenticated attacker can trigger the condition over the network without user interaction, exhausting server-side resources and making the service unavailable.
The issue affects Apache Tomcat 11.0.0-M5 through 11.0.25, 10.1.8 through 10.1.59, and 9.0.74 through 9.0.121. End-of-life 8.5.88 through 8.5.100 branches are also impacted. The Apache Tomcat project recommends upgrading to 11.0.26, 10.1.60, or 9.0.122.
Critical Impact
Remote unauthenticated attackers can send crafted WebSocket close messages to exhaust Tomcat resources and cause a denial of service against production web applications.
Affected Products
- Apache Tomcat 11.0.0-M5 through 11.0.25
- Apache Tomcat 10.1.8 through 10.1.59
- Apache Tomcat 9.0.74 through 9.0.121 (and EOL 8.5.88 through 8.5.100)
Discovery Timeline
- 2026-09-23 - CVE-2026-77791 published to the National Vulnerability Database (NVD)
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-77791
Vulnerability Analysis
CVE-2026-77791 is a denial of service vulnerability in Apache Tomcat's WebSocket implementation. When Tomcat sends a WebSocket close message, the affected code path fails to bound resource usage. Attackers can exploit this behavior by manipulating WebSocket sessions so that the server consumes excessive resources during close-frame emission.
The impact is limited to availability. Confidentiality and integrity of application data are not affected. However, sustained exploitation can render the Tomcat instance and any hosted applications unreachable to legitimate users.
Root Cause
The root cause is uncontrolled resource consumption [CWE-400] in the WebSocket close message send path. Tomcat does not sufficiently constrain the work performed when transmitting close frames, allowing resource use to grow beyond safe limits under attacker-influenced conditions.
Attack Vector
Exploitation occurs over the network against any Tomcat endpoint exposing WebSocket connectivity. The attacker requires no privileges and no user interaction. By initiating and manipulating WebSocket sessions to trigger close-message handling under adversarial conditions, an attacker can drive the server into a resource-exhausted state.
No public proof-of-concept exploit is currently listed for this issue, and CISA has not added it to the Known Exploited Vulnerabilities catalog. See the Apache Mailing List Thread and the Openwall OSS-Security Update for the coordinated disclosure details.
Detection Methods for CVE-2026-77791
Indicators of Compromise
- Sudden spikes in Tomcat CPU, memory, or thread usage correlated with WebSocket traffic on /ws or application-specific WebSocket endpoints.
- Elevated counts of WebSocket close frames or abnormal close-code patterns in access and application logs.
- Application unavailability, request queueing, or connection timeouts affecting Tomcat-hosted services without a corresponding legitimate traffic increase.
Detection Strategies
- Inventory Tomcat deployments and compare installed versions against the fixed releases 11.0.26, 10.1.60, and 9.0.122.
- Enable WebSocket-aware logging in Tomcat and forward access logs, garbage collection metrics, and thread dumps to a central analytics platform.
- Baseline normal WebSocket session lifecycles and alert on deviations in close-frame frequency, session duration, or per-client connection rates.
Monitoring Recommendations
- Monitor JVM metrics such as heap usage, thread count, and file descriptor consumption on all Tomcat hosts.
- Track connection counts and close-frame rates per source IP to identify abusive clients attempting resource exhaustion.
- Alert on repeated Tomcat restarts, out-of-memory events, or connector saturation that may indicate active exploitation.
How to Mitigate CVE-2026-77791
Immediate Actions Required
- Upgrade Apache Tomcat to 11.0.26, 10.1.60, or 9.0.122 as applicable to your major version branch.
- Retire or replace any 8.5.x deployments, which are end-of-life and remain exposed to this class of issue.
- Rate-limit inbound WebSocket connections at upstream reverse proxies or web application firewalls until patching is complete.
Patch Information
The Apache Tomcat project has released fixed versions 11.0.26, 10.1.60, and 9.0.122. Administrators should plan upgrades according to their existing change management processes. Refer to the Apache Mailing List Thread for release notes and to the Openwall OSS-Security Update for coordinated disclosure notes.
Workarounds
- Disable WebSocket endpoints in web.xml or application configuration where they are not required by the application.
- Enforce connection and request quotas at a reverse proxy such as NGINX, HAProxy, or a WAF placed in front of Tomcat.
- Restrict WebSocket exposure to authenticated network zones using firewall rules or mutual TLS while patching is planned.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
