CVE-2026-73180

A flaw was found in Apache Tomcat. This vulnerability, categorized as Insufficient Session Expiration, occurs when an authenticated HTTP session's ID is modified after a WebSocket connection has been established. Under these conditions, the WebSocket session fails to terminate as expected when the associated HTTP session ends. This could allow an attacker to maintain an active WebSocket session, potentially leading to unauthorized access or information disclosure.

This Moderate flaw in Apache Tomcat allows an authenticated WebSocket session to persist even after its associated HTTP session has terminated, provided the HTTP session ID was changed after WebSocket establishment. This could lead to unauthorized access or information disclosure in Red Hat environments where Apache Tomcat applications utilize WebSockets with dynamic session ID management, extending access beyond the intended HTTP session lifetime.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.