CVE-2026-87022: Apache Tomcat WebSocket Smuggling Vulnerability

CVE-2026-87022 Overview

CVE-2026-87022 is an improper handling of length parameter inconsistency vulnerability [CWE-130] in Apache Tomcat. The flaw allows WebSocket message smuggling when the per-message-deflate extension is enabled. Attackers can send crafted WebSocket frames that are parsed inconsistently, injecting unauthorized messages into an active session. The vulnerability affects Apache Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121. End-of-support branches 8.5.0 through 8.5.100 and 7.0.56 through 7.0.109 are also affected. The Apache Software Foundation released fixed versions 11.0.26, 10.1.60, and 9.1.22.

Critical Impact
Remote attackers can smuggle WebSocket messages over network without authentication, compromising message integrity in applications using compressed WebSocket streams.

Affected Products

Apache Tomcat 11.0.0-M1 through 11.0.25
Apache Tomcat 10.1.0-M1 through 10.1.59
Apache Tomcat 9.0.0.M1 through 9.0.121 (and EOS branches 8.5.0-8.5.100, 7.0.56-7.0.109)

Discovery Timeline

2026-09-23 - CVE CVE-2026-87022 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-87022

Vulnerability Analysis

The vulnerability resides in Apache Tomcat's WebSocket implementation when the per-message-deflate extension is negotiated. The server processes compressed WebSocket frames using length metadata that is not validated consistently against the actual payload boundary. This inconsistency lets an attacker embed additional WebSocket messages inside a single compressed frame. The receiving application then processes smuggled messages as if they originated from a legitimate sender. The impact is scoped to integrity: attackers cannot directly read confidential data or crash the service, but they can inject unauthorized commands into WebSocket-driven workflows such as chat, trading, real-time collaboration, and IoT control channels.

Root Cause

The root cause is classified under [CWE-130] Improper Handling of Length Parameter Inconsistency. Tomcat's WebSocket frame parser trusts a length field that can diverge from the decompressed message boundary. When per-message-deflate inflates the payload, the parser fails to reconcile the declared length with the actual inflated content, allowing trailing bytes to be interpreted as a separate message.

Attack Vector

Exploitation requires no authentication and no user interaction. The attacker establishes a WebSocket connection that negotiates the per-message-deflate extension, then transmits a crafted compressed frame with inconsistent length metadata. Any Tomcat deployment terminating WebSocket traffic with compression enabled is reachable over the network. See the Apache Mailing List Discussion and OpenWall OSS Security Update for protocol-level detail.

Detection Methods for CVE-2026-87022

Indicators of Compromise

Unexpected WebSocket messages appearing in application logs without matching client send events.
WebSocket handshakes negotiating the permessage-deflate extension followed by anomalous frame patterns.
Application-layer actions attributed to sessions that show timing gaps inconsistent with legitimate client behavior.

Detection Strategies

Inspect WebSocket frames at a reverse proxy or WAF for compressed payloads whose inflated size does not match the declared length.
Correlate application-level message counts against network-level frame counts per session to surface smuggled messages.
Alert on Tomcat versions in the affected ranges by querying asset inventories for server.info strings matching 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, or 9.0.0.M1 through 9.0.121.

Monitoring Recommendations

Log all WebSocket upgrade requests including negotiated extensions and forward them to a centralized SIEM.
Monitor Apache Tomcat access and catalina logs for abnormal WebSocket session behavior and errors from the frame parser.
Track outbound actions triggered by WebSocket sessions and baseline normal per-user message rates.

How to Mitigate CVE-2026-87022

Immediate Actions Required

Upgrade Apache Tomcat to version 11.0.26, 10.1.60, or 9.1.22 as listed in the vendor advisory.
Inventory all Tomcat instances and identify those exposing WebSocket endpoints with compression enabled.
Restrict network exposure of WebSocket endpoints to trusted clients until patching is complete.

Patch Information

The Apache Software Foundation fixed the vulnerability in Tomcat 11.0.26, 10.1.60, and 9.1.22. Deployments on end-of-support branches 8.5.x and 7.0.x will not receive patches and should be migrated to a supported branch. Refer to the Apache Mailing List Discussion for release details.

Workarounds

Disable the per-message-deflate WebSocket extension in Tomcat configuration to eliminate the attack surface.
Terminate WebSocket connections at an upstream proxy that strips or rejects the permessage-deflate extension header.
Enforce strict message length and rate limits at the application layer to reduce the impact of smuggled frames.

bash

# Disable per-message-deflate by omitting the extension in the server configuration
# Example: reject the extension at an Nginx reverse proxy
proxy_set_header Sec-WebSocket-Extensions "";