Loading vulnerability…
Memory-exhaustion denial of service in Apache Tomcat WebSocket chat example
CVE-2026-66299 is an uncontrolled resource-consumption vulnerability in Apache Tomcat's WebSocket chat example. The example maintains an unbounded buffer of undelivered messages, allowing maliciously slow clients to cause queued messages to accumulate and exhaust server memory. Affected versions are 11.0.0-M20 through 11.0.24, 10.1.24 through 10.1.57, and 9.0.89 through 9.0.120. Exploitation can cause denial of service. Deployments with the examples web application removed are not affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote unauthenticated attacker can cause excessive memory consumption and denial of service by preventing timely delivery of WebSocket chat messages. Memory exhaustion can degrade or interrupt the affected Tomcat service, potentially affecting other applications sharing the same JVM. No confidentiality or integrity impact is established for this vulnerability.
If you can’t patch tonight, do this now.
Remove the Tomcat examples web application in accordance with Apache security guidance. Deployments where it has already been removed are not affected. If removal and patching cannot be performed immediately, restrict network access to the WebSocket chat example to reduce exposure.
Patch, then assume compromise.
Upgrade to Apache Tomcat 11.0.25 or later, 10.1.58 or later, or 9.0.121 or later in the corresponding release branch. The corrected implementation limits message buffering in the WebSocket chat example. For vendor-packaged or embedded Tomcat deployments, apply the corresponding vendor security update. Removing the examples web application also eliminates the vulnerable component.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.