CVE-2026-66299

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M20 through 11.0.24 Apache Tomcat versions 10.1.24 through 10.1.57 Apache Tomcat versions 9.0.89 through 9.0.120

Description An uncontrolled resource consumption issue exists in the WebSocket chat example. The application uses an unbounded buffer for undelivered messages, allowing a maliciously slow client to cause the buffer to grow continuously. This can lead to memory exhaustion and the subsequent failure of the Tomcat process.

Recommendations Upgrade to version 11.0.25. Upgrade to version 10.1.58. Upgrade to version 9.0.121. Remove the examples web application.