CVE-2026-79677 Overview
CVE-2026-79677 is a denial of service vulnerability in Apache Tomcat caused by missing resource release and incorrect timeout comparisons for asynchronous WebSocket writes. The flaw is tracked under CWE-772: Missing Release of Resource after Effective Lifetime. Remote attackers can exhaust server resources over the network without authentication or user interaction.
The issue affects Apache Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121. End-of-life branches 8.5.0 through 8.5.100 and 7.0.43 through 7.0.109 are also known to be affected. Fixed versions are 11.0.26, 10.1.60, and 9.0.122.
Critical Impact
Unauthenticated remote attackers can trigger sustained resource exhaustion on Tomcat WebSocket endpoints, degrading or halting application availability.
Affected Products
- Apache Tomcat 11.0.0-M1 through 11.0.25
- Apache Tomcat 10.1.0-M1 through 10.1.59
- Apache Tomcat 9.0.0.M1 through 9.0.121 (also 8.5.0–8.5.100 and 7.0.43–7.0.109, end-of-life)
Discovery Timeline
- 2026-09-23 - CVE-2026-79677 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-79677
Vulnerability Analysis
Apache Tomcat implements WebSocket messaging through its jakarta.websocket (or javax.websocket on older branches) container. Asynchronous write operations rely on timeouts to release resources when a peer becomes unresponsive. This vulnerability breaks that timeout mechanism.
When an asynchronous WebSocket write is issued, Tomcat compares timeout values using incorrect factors. As a result, the timeout is effectively lost and the write never completes or fails cleanly. The connection, buffers, and associated worker resources remain allocated for the effective lifetime of the process.
An attacker can exploit this behavior by opening WebSocket sessions and inducing conditions that stall server-side asynchronous writes. Each stalled write consumes memory, threads, and file descriptors that Tomcat cannot reclaim, degrading availability for legitimate clients.
Root Cause
The root cause is twofold, aligning with [CWE-772]. First, the timeout comparison uses wrong factors, so expiration logic fails to fire for asynchronous WebSocket writes. Second, without a triggered timeout, Tomcat never releases the resources tied to the stalled write, producing an unbounded accumulation over time.
Attack Vector
Exploitation is network-based, requires no privileges, and needs no user interaction. Any application exposing WebSocket endpoints on affected Tomcat versions is reachable. An attacker repeatedly initiates WebSocket sessions and triggers slow or unacknowledged server writes to accumulate leaked resources until the server becomes unresponsive.
No verified proof-of-concept code is publicly available at this time. Refer to the Apache Mailing List Thread and the OpenWall Security Discussion for advisory details.
Detection Methods for CVE-2026-79677
Indicators of Compromise
- Sustained growth in Tomcat JVM heap usage, thread counts, or open file descriptors without a corresponding increase in successful request throughput.
- Elevated counts of long-lived WebSocket sessions where server-side asynchronous writes never complete.
- Access logs showing repeated WebSocket upgrade requests from a narrow set of source addresses followed by client-side inactivity.
Detection Strategies
- Inventory all Java applications running on Apache Tomcat and compare deployed versions against the fixed releases 11.0.26, 10.1.60, and 9.0.122.
- Instrument the WebSocket container with JMX metrics to alert on rising counts of active sessions and pending asynchronous writes.
- Correlate network telemetry for anomalous volumes of HTTP/1.1 101 Switching Protocols responses tied to short-lived source addresses.
Monitoring Recommendations
- Continuously monitor Tomcat Catalina MBeans for connector thread pool saturation and rejected task counts.
- Track operating system metrics for file descriptor and memory pressure on Tomcat hosts and alert before exhaustion.
- Forward Tomcat access and catalina logs to a centralized analytics platform to baseline WebSocket connection patterns and detect deviation.
How to Mitigate CVE-2026-79677
Immediate Actions Required
- Upgrade Apache Tomcat to 11.0.26, 10.1.60, or 9.0.122 depending on the deployed branch.
- Retire any deployments on end-of-life 8.5.x and 7.0.x branches, which will not receive fixes.
- Restrict network exposure of WebSocket endpoints to trusted networks or place them behind a reverse proxy that enforces connection limits.
Patch Information
Apache has released fixed versions 11.0.26, 10.1.60, and 9.0.122 that correct the timeout comparison and release resources for asynchronous WebSocket writes. Review the Apache Mailing List Thread and the OpenWall Security Discussion for release notes and upgrade guidance.
Workarounds
- Disable WebSocket endpoints in applications that do not require them until patching is complete.
- Enforce aggressive per-source connection and rate limits at an upstream load balancer or web application firewall.
- Reduce maxConnections and connector thread pool sizes on the Tomcat connector to bound resource accumulation and schedule periodic restarts as a stopgap.
# Configuration example: reduce exposure while patching
# Example server.xml connector tuning to cap concurrent connections
# <Connector port="8080" protocol="HTTP/1.1"
# connectionTimeout="20000"
# maxConnections="1000"
# maxThreads="200"
# acceptCount="50" />
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
