CVE-2026-77791

A flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability occurs when sending a WebSocket close message, which can lead to a busy wait condition. A remote attacker could exploit this to cause a Denial of Service (DoS) by making the server unresponsive.

Red Hat rates this vulnerability as Important because an unauthenticated remote client can cause severe CPU starvation and exhaust worker threads without requiring administrative privileges. Exploitation occurs during the termination of WebSocket sessions, forcing the application server into an infinite busy-wait loop that degrades availability for all hosted applications. Deployments are primarily exposed when running web applications that define WebSocket endpoints accessible over untrusted public networks.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available.