Description

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-25T22:17:06.107Z",
  "pubdate": "2026-08-25T22:17:06.107Z",
  "executiveSummary": "An Insufficient Session Expiration vulnerability exists within Apache Tomcat, impacting the handling of Jakarta WebSocket sessions during HTTP session lifecycle changes. The vulnerability arises when an authenticated HTTP session ID is modified after a WebSocket connection has been established. Under these conditions, the WebSocket session fails to terminate as mandated by the Jakarta WebSocket specification, potentially leaving authenticated tunnels active despite the invalidation or rotation of the associated parent HTTP session.\nThe flaw affects multiple branches of Apache Tomcat, including 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.0.M1 through 9.0.120, alongside EOL versions 8.5.0 through 8.5.100 and 7.0.43 through 7.0.109. This vulnerability permits an attacker to maintain unauthorized access to established WebSocket channels if they can induce a session change without triggering the necessary cleanup protocols. The primary risk involves the violation of security boundaries and session management policies, where a decommissioned session context remains active within the application container. Exploitation requires the ability to influence session state, posing a risk to systems relying on strict session lifecycle enforcement for WebSocket communication.",
  "technicalDetails": "The core of this vulnerability lies in a logic error within the Jakarta WebSocket implementation in Apache Tomcat. The Jakarta WebSocket specification explicitly requires that a WebSocket connection must be associated with the security context of the parent HTTP session. If the parent HTTP session is invalidated or its identifier is rotated, the WebSocket session is expected to propagate this state change and terminate accordingly. Apache Tomcat fails to enforce this synchronization when a session ID change occurs post-handshake.\nThe attack flow begins with an adversary or user establishing a legitimate WebSocket connection under an authenticated HTTP session. Once the connection is stable, an event occurs—either through legitimate session rotation or an attacker-triggered session modification—that changes the session ID. Because the internal reference mapping between the WebSocket session and the original, now-deprecated HTTP session remains, the container fails to trigger the mandatory closure sequence. The WebSocket handler continues to permit communication as if the original session state were still valid.\nTechnically, the vulnerability involves an improper implementation of session-listener-to-WebSocket-endpoint event propagation. When the HTTP session identifier is updated, the internal session management logic does not notify the WebSocket engine to verify the validity of the current session token against the active connection. Consequently, the WebSocket connection remains 'zombie'—technically alive but orphaned from the validated parent session context.\nThe vulnerability is exposed via the network through the WebSocket protocol (ws:// or wss://). It does not require specialized privilege escalation in the underlying OS; rather, it exploits the container's internal session management state machine. The affected components are the Tomcat WebSocket engine and the session manager. Successful exploitation allows an attacker to continue transmitting and receiving data through the WebSocket tunnel even if the underlying security context has been explicitly marked for expiration or invalidated.\nPost-exploitation, an attacker can bypass security mechanisms that rely on short-lived sessions or session rotation as a defensive hardening measure against hijacking. Since the socket remains open, the attacker retains an established communication channel, which may be leveraged to exfiltrate sensitive data or interact with authenticated backend logic that assumes the existence of a valid, active session. The persistence of these connections defies administrative efforts to revoke access by invalidating session tokens, significantly extending the potential window of unauthorized access."
}