CVE-2026-87022: Apache Tomcat WebSocket Message Smuggling Vulnerability
Summary
CVE-2026-87022: Apache Tomcat: WebSocket message smuggling with per-message-deflate. Affects tomcat across 4 version ranges.
>= 7.0.56, < 9.0.45
>= 9.0.0, < 9.0.122
>= 10.1.0, < 10.1.60
>= 11.0.0, < 11.0.26
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java applications and provides a robust environment for running web applications. However, certain versions of Tomcat are vulnerable to a specific issue related to WebSocket message handling, particularly when using the per-message-deflate feature.
Vulnerability Detail
The vulnerability arises from improper handling of length parameter inconsistencies in Apache Tomcat, which can lead to WebSocket message smuggling. This issue affects multiple versions of Tomcat, allowing attackers to exploit the flaw and potentially manipulate WebSocket messages. The vulnerability is particularly critical as it can compromise the integrity of the data being transmitted, leading to unauthorized access or data manipulation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.56, < 9.0.459.0.45 -
>= 9.0.0, < 9.0.1229.0.122 -
>= 10.1.0, < 10.1.6010.1.60 -
>= 11.0.0, < 11.0.2611.0.26
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider disabling the per-message-deflate feature in WebSocket configurations to mitigate the risk until a proper update can be applied. This can typically be done in the server configuration files where WebSocket settings are defined.
Conclusion
The CVE-2026-87022 vulnerability in Apache Tomcat highlights a critical issue with WebSocket message handling that can lead to serious security risks. Users are strongly advised to upgrade to the latest patched versions to safeguard their applications. For those unable to upgrade immediately, disabling the per-message-deflate feature can serve as a temporary workaround.
See every vulnerability recorded for tomcat →
FAQ
The vulnerability affects Apache Tomcat versions from 11.0.0 through 11.0.25, 10.1.0 through 10.1.59, and 9.0.0 through 9.0.121. Older versions, such as 8.5.0 through 8.5.100 and 7.0.56 through 7.0.109, are also affected.
WebSocket message smuggling is a technique used by attackers to manipulate the communication between a client and server, allowing them to inject or alter messages without detection.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply providing a manifest file like package-lock.json, you can check for vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to test your application without signup.
If exploited, this vulnerability can lead to unauthorized access to sensitive data, data manipulation, and overall compromise of the application's integrity.
Yes, you can temporarily disable the per-message-deflate feature in your WebSocket configurations to reduce the risk until you can upgrade to a patched version.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat.
