{"api_version":"1","generated_at":"2026-08-26T03:59:07+00:00","cve":"CVE-2026-73180","urls":{"html":"https://cve.report/CVE-2026-73180","api":"https://cve.report/api/cve/CVE-2026-73180.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-73180","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-73180"},"summary":{"title":"Apache Tomcat: Authenticated WebSocket session survives end of HTTP session","description":"Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.","state":"PUBLISHED","assigner":"apache","published_at":"2026-08-25 22:17:06","updated_at":"2026-08-25 22:17:06"},"problem_types":["CWE-613","CWE-613 CWE-613 Insufficient Session Expiration"],"metrics":[],"references":[{"url":"https://lists.apache.org/thread/3j15vztszpyqss253mjq5v1kp7s6hooq","name":"https://lists.apache.org/thread/3j15vztszpyqss253mjq5v1kp7s6hooq","refsource":"security@apache.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73180","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73180","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Tomcat","version":"affected 11.0.0-M1 11.0.24 semver","platforms":[]},{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Tomcat","version":"affected 10.1.0-M1 10.1.57 semver","platforms":[]},{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Tomcat","version":"affected 9.0.0.M1 9.0.120 semver","platforms":[]},{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Tomcat","version":"affected 8.5.0 8.5.100 semver","platforms":[]},{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Tomcat","version":"affected 7.0.43 7.0.109 semver","platforms":[]},{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Tomcat","version":"unaffected 7.0.43 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"0xCc.zhang","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Apache Tomcat","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"11.0.24","status":"affected","version":"11.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.1.57","status":"affected","version":"10.1.0-M1","versionType":"semver"},{"lessThanOrEqual":"9.0.120","status":"affected","version":"9.0.0.M1","versionType":"semver"},{"lessThanOrEqual":"8.5.100","status":"affected","version":"8.5.0","versionType":"semver"},{"lessThanOrEqual":"7.0.109","status":"affected","version":"7.0.43","versionType":"semver"},{"lessThan":"7.0.43","status":"unaffected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"0xCc.zhang"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended.</p><p>This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.</p><p>The following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109.&nbsp;Other unsupported versions may also be affected.</p><p>Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.</p>"}],"value":"Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue."}],"metrics":[{"other":{"content":{"text":"low"},"type":"Textual description of severity"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-613","description":"CWE-613 Insufficient Session Expiration","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-25T22:01:58.000Z","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache"},"references":[{"tags":["vendor-advisory"],"url":"https://lists.apache.org/thread/3j15vztszpyqss253mjq5v1kp7s6hooq"}],"source":{"discovery":"EXTERNAL"},"title":"Apache Tomcat: Authenticated WebSocket session survives end of HTTP session","x_generator":{"engine":"Vulnogram 0.2.0"}}},"cveMetadata":{"assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","assignerShortName":"apache","cveId":"CVE-2026-73180","datePublished":"2026-08-25T22:01:58.000Z","dateReserved":"2026-08-11T10:58:04.221Z","dateUpdated":"2026-08-25T22:01:58.000Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-25 22:17:06","lastModifiedDate":"2026-08-25 22:17:06","problem_types":["CWE-613","CWE-613 CWE-613 Insufficient Session Expiration"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"73180","Ordinal":"1","Title":"Apache Tomcat: Authenticated WebSocket session survives end of H","CVE":"CVE-2026-73180","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"73180","Ordinal":"1","NoteData":"Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.","Type":"Description","Title":"Apache Tomcat: Authenticated WebSocket session survives end of H"}]}}}