CVE-2026-66299

A flaw was found in Apache Tomcat. This uncontrolled resource consumption vulnerability, located in the WebSocket chat example, allows a remote attacker to cause a Denial of Service (DoS) by exhausting system resources. This can lead to the affected system becoming unresponsive or crashing.

This Moderate severity flaw in Apache Tomcat's WebSocket chat example could lead to a denial of service. The impact is limited as the vulnerable component is part of an example application, which is generally not deployed in production environments. Exploitation requires the example application to be present and accessible.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, remove the examples web application from your Apache Tomcat installation. This can typically be achieved by deleting the examples directory or examples.war file from the webapps directory of your Tomcat installation. A restart of the Tomcat service may be required for the changes to take full effect.