{
  "cveId": "CVE-2026-66299",
  "url": "https://patchblox.com/security/cve/CVE-2026-66299",
  "summary": "CVE-2026-66299 is fixed in 5 products on 1 platform, first by DEBIAN-CVE-2026-66299, released July 31, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "tomcat9: Uncontrolled Resource Consumption vulnerability in Apache Tomcat\u0027s WebSocket chat example",
  "description": "Uncontrolled Resource Consumption vulnerability in Apache Tomcat\u0027s WebSocket chat example.  This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue.  Users are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue.",
  "published": "2026-07-28T14:29:05Z",
  "severity": "medium",
  "cvss": 5.3,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "epss": 0.00553,
  "epssPercentile": 0.46415,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "jws6-tomcat",
      "release": "RHEL 10",
      "fixedVersion": "10.1.49-16.redhat_00016.1.el10jws",
      "fix": "RHSA-2026:73981",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-73981",
      "released": "2026-08-25T22:01:58Z"
    },
    {
      "platform": "linux",
      "product": "tomcat",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "9.0.121-160000.1.1",
      "fix": "OPENSUSE-SU-2026:21823-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21823-1",
      "released": "2026-09-09T14:18:23Z"
    },
    {
      "platform": "linux",
      "product": "tomcat",
      "release": "sles 15.6",
      "fixedVersion": "9.0.121-150200.120.1",
      "fix": "SUSE-SU-2026:4203-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4203-1",
      "released": "2026-09-16T08:19:50Z"
    },
    {
      "platform": "linux",
      "product": "tomcat",
      "release": "sles 15.7",
      "fixedVersion": "9.0.121-150200.120.1",
      "fix": "SUSE-SU-2026:4203-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4203-1",
      "released": "2026-09-16T08:19:50Z"
    },
    {
      "platform": "linux",
      "product": "tomcat",
      "release": "sles 16.0",
      "fixedVersion": "9.0.121-160000.1.1",
      "fix": "SUSE-SU-2026:23720-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23720-1",
      "released": "2026-09-09T14:15:48Z"
    },
    {
      "platform": "linux",
      "product": "tomcat10",
      "release": "Debian 14",
      "fixedVersion": "10.1.60-1",
      "fix": "DEBIAN-CVE-2026-66299",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-66299",
      "released": "2026-07-31T14:18:19Z"
    },
    {
      "platform": "linux",
      "product": "tomcat10",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "10.1.59-160000.1.1",
      "fix": "OPENSUSE-SU-2026:21810-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21810-1",
      "released": "2026-09-08T15:47:18Z"
    },
    {
      "platform": "linux",
      "product": "tomcat10",
      "release": "sles 15.6",
      "fixedVersion": "10.1.59-150200.5.79.1",
      "fix": "SUSE-SU-2026:4119-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4119-1",
      "released": "2026-09-10T08:16:50Z"
    },
    {
      "platform": "linux",
      "product": "tomcat10",
      "release": "sles 15.7",
      "fixedVersion": "10.1.59-150200.5.79.1",
      "fix": "SUSE-SU-2026:4119-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4119-1",
      "released": "2026-09-10T08:16:50Z"
    },
    {
      "platform": "linux",
      "product": "tomcat10",
      "release": "sles 16.0",
      "fixedVersion": "10.1.59-160000.1.1",
      "fix": "SUSE-SU-2026:23711-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23711-1",
      "released": "2026-09-08T15:49:49Z"
    },
    {
      "platform": "linux",
      "product": "tomcat11",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "11.0.25-160000.1.1",
      "fix": "OPENSUSE-SU-2026:21811-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21811-1",
      "released": "2026-09-08T15:45:34Z"
    },
    {
      "platform": "linux",
      "product": "tomcat11",
      "release": "sles 15.6",
      "fixedVersion": "11.0.25-150600.13.33.2",
      "fix": "SUSE-SU-2026:4114-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4114-1",
      "released": "2026-09-09T16:20:46Z"
    },
    {
      "platform": "linux",
      "product": "tomcat11",
      "release": "sles 15.7",
      "fixedVersion": "11.0.25-150600.13.33.2",
      "fix": "SUSE-SU-2026:4114-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4114-1",
      "released": "2026-09-09T16:20:46Z"
    },
    {
      "platform": "linux",
      "product": "tomcat11",
      "release": "sles 16.0",
      "fixedVersion": "11.0.25-160000.1.1",
      "fix": "SUSE-SU-2026:23710-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23710-1",
      "released": "2026-09-08T15:49:50Z"
    },
    {
      "platform": "linux",
      "product": "tomcat9",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "9.0.70-2",
      "fix": "DEBIAN-CVE-2026-66299",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-66299",
      "released": "2026-07-31T14:18:19Z"
    },
    {
      "platform": "linux",
      "product": "tomcat9",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "9.0.70-2",
      "fix": "DEBIAN-CVE-2026-66299",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-66299",
      "released": "2026-07-31T14:18:19Z"
    },
    {
      "platform": "linux",
      "product": "tomcat9",
      "release": "Debian 14",
      "fixedVersion": "9.0.70-2",
      "fix": "DEBIAN-CVE-2026-66299",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-66299",
      "released": "2026-07-31T14:18:19Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}