AIKIDO-2026-261675
tomcat is vulnerable to Denial of Service
53
Medium Risk
This Affects:
tomcatTL;DR
tomcat ships a WebSocket chat example that keeps an unbounded buffer for undelivered messages. A slow client can grow that buffer until the Tomcat process runs out of memory. Deployments that already removed the examples web application are not exposed. The fix bounds the example's undelivered-message buffer.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and the examples web application is still deployed.
Background info
tomcat is vulnerable to Denial of Service in versions 9.0.89 - 9.0.120, 10.1.24 - 10.1.57 and 11.0.0 - 11.0.24.
How to fix this
Upgrade the org.apache.tomcat:tomcat library to the patch version.
Links
tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.25lists.apache.org/thread/8owczcc1o8qw1rxmg9gvfk4w2jnh4l5kopenwall.com/lists/oss-security/2026/07/28/25
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.