← Vulnerability feed

Vulnerability record · CVE-2026-79677 · published 23 September 2026

CVE-2026-79677: Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache T…

Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

7.5 CVSS 3.1 High EPSS 0.32% · top 77.2% CWE-772 · CWE-772CWE-1025 · CWE-1025 Awaiting Analysis
7.5CVSS 3.1 base score
0.32%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
2References
23 Sep 2026Last modified by NVD

Description

Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

LinkTags
https://lists.apache.org/thread/bzwps6ck4szf2hmksbbon3syyl9qnkv8
http://www.openwall.com/lists/oss-security/2026/09/23/27

Track CVE-2026-79677 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

5.8CVE-2024-20481Cisco ASA and FTD RAVPN resource exhaustion denial of serviceCisco ASA and FTD Remote Access VPN services can be driven into resource exhaustion by a flood of VPN authentication requests. The flaw is a resource…KEVEPSS 16%analysed

Source: NIST National Vulnerability Database (record CVE-2026-79677), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.