PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›Document archive›CVE-2026-87022

CVE-2026-87022

tomcat: Apache Tomcat: WebSocket message smuggling via improper length handling

Loading…

Severity

Low

Red Hat Product Security

6.5

CVSS 3.1

Review impact separately from score.

Published · September 23, 2026

Updated · October 8, 2026

Description

A flaw was found in Apache Tomcat. This vulnerability, related to improper handling of length parameters, allows for WebSocket message smuggling when the 'per-message-deflate' extension is in use. A remote attacker could exploit this to bypass security controls or inject malicious data into WebSocket communications, potentially leading to unauthorized actions or information disclosure.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-130 · Improper Handling of Length Parameter Inconsistency