Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue. Users are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue.

According to its self-reported version number, the version of Apache Tomcat installed on the remote host is 9.0.89 prior to 9.0.121, 10.1.24 prior 10.1.58, or 11.0.0-M20 prior 11.0.25. It is, therefore, affected by a denial of service vulnerability due to an unbounded buffer for undelivered messages in the WebSocket chat example application. A maliciously slow client can cause the buffer to grow continuously, eventually leading to memory exhaustion and failure of the Tomcat process.

Note that the scanner has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue     affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through     9.0.120. Users who have followed the security guidance to remove the examples web application are not     affected by this issue. Users are recommended to remove the examples web application or to upgrade to     version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue. (CVE-2026-66299)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tomcat installed on the remote host is prior to 9.0.121. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_9.0.121_security-9 advisory.

  - Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue     affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through     9.0.120. Users who have followed the security guidance to remove the examples web application are not     affected by this issue. Users are recommended to remove the examples web application or to upgrade to     version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue. (CVE-2026-66299)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 11.0.25. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_11.0.25_security-11 advisory.

  - Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue     affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through     9.0.120. Users who have followed the security guidance to remove the examples web application are not     affected by this issue. Users are recommended to remove the examples web application or to upgrade to     version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue. (CVE-2026-66299)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 10.1.58. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_10.1.58_security-10 advisory.

  - Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue     affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through     9.0.120. Users who have followed the security guidance to remove the examples web application are not     affected by this issue. Users are recommended to remove the examples web application or to upgrade to     version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue. (CVE-2026-66299)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
115351	Apache Tomcat 9.0.89 < 9.0.121 Denial of Service	Web App Scanning	Component Vulnerability	Version Based	high
115350	Apache Tomcat 10.1.24 < 10.1.58 Denial of Service	Web App Scanning	Component Vulnerability	Version Based	high
115349	Apache Tomcat 11.0.0-M20 < 11.0.25 Denial of Service	Web App Scanning	Component Vulnerability	Version Based	high
330598	Linux Distros Unpatched Vulnerability : CVE-2026-66299	Nessus	Misc.	Local	high
330442	Apache Tomcat 9.0.89 < 9.0.121	Nessus	Web Servers	Combined	high
330425	Apache Tomcat 11.0.0.M20 < 11.0.25	Nessus	Web Servers	Combined	high
330424	Apache Tomcat 10.1.24 < 10.1.58	Nessus	Web Servers	Combined	high

Detections

Analytics

CVE-2026-66299

high

Tenable Plugins

high

high

high

high

high

high

high