Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Tomcat may keep WebSocket connections open after logout
published 2 months ago
Summary
The Tomcat web server and its related components can continue to keep WebSocket connections active even after a user’s login session ends. This can allow unwanted data exchange or resource use after logout. Apply the latest Tomcat updates for all listed Almalinux packages to resolve the issue.
What to do
- Update almalinux tomcat to version 1:9.0.87-3.el9_6.3.tuxcare.els17.
- Update almalinux tomcat-admin-webapps to version 1:9.0.87-3.el9_6.3.tuxcare.els17.
- Update almalinux tomcat-docs-webapp to version 1:9.0.87-3.el9_6.3.tuxcare.els17.
- Update almalinux tomcat-el-3.0-api to version 1:9.0.87-3.el9_6.3.tuxcare.els17.
- Update almalinux tomcat-jsp-2.3-api to version 1:9.0.87-3.el9_6.3.tuxcare.els17.
- Update almalinux tomcat-lib to version 1:9.0.87-3.el9_6.3.tuxcare.els17.
- Update almalinux tomcat-servlet-4.0-api to version 1:9.0.87-3.el9_6.3.tuxcare.els17.
- Update almalinux tomcat-webapps to version 1:9.0.87-3.el9_6.3.tuxcare.els17.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:AlmaLinux:9.6 | almalinux | tomcat |
< 1:9.0.87-3.el9_6.3.tuxcare.els17 Fix: upgrade to 1:9.0.87-3.el9_6.3.tuxcare.els17
|
| TuxCare:AlmaLinux:9.6 | almalinux | tomcat-admin-webapps |
< 1:9.0.87-3.el9_6.3.tuxcare.els17 Fix: upgrade to 1:9.0.87-3.el9_6.3.tuxcare.els17
|
| TuxCare:AlmaLinux:9.6 | almalinux | tomcat-docs-webapp |
< 1:9.0.87-3.el9_6.3.tuxcare.els17 Fix: upgrade to 1:9.0.87-3.el9_6.3.tuxcare.els17
|
| TuxCare:AlmaLinux:9.6 | almalinux | tomcat-el-3.0-api |
< 1:9.0.87-3.el9_6.3.tuxcare.els17 Fix: upgrade to 1:9.0.87-3.el9_6.3.tuxcare.els17
|
| TuxCare:AlmaLinux:9.6 | almalinux | tomcat-jsp-2.3-api |
< 1:9.0.87-3.el9_6.3.tuxcare.els17 Fix: upgrade to 1:9.0.87-3.el9_6.3.tuxcare.els17
|
| TuxCare:AlmaLinux:9.6 | almalinux | tomcat-lib |
< 1:9.0.87-3.el9_6.3.tuxcare.els17 Fix: upgrade to 1:9.0.87-3.el9_6.3.tuxcare.els17
|
| TuxCare:AlmaLinux:9.6 | almalinux | tomcat-servlet-4.0-api |
< 1:9.0.87-3.el9_6.3.tuxcare.els17 Fix: upgrade to 1:9.0.87-3.el9_6.3.tuxcare.els17
|
| TuxCare:AlmaLinux:9.6 | almalinux | tomcat-webapps |
< 1:9.0.87-3.el9_6.3.tuxcare.els17 Fix: upgrade to 1:9.0.87-3.el9_6.3.tuxcare.els17
|
Original advisory text
tomcat: Fix of CVE-2026-73180
- CVE-2026-73180: track the WebSocket sessions of an authenticated HTTP session by a key
held in a session attribute rather than the live session id, so they are still closed
when the HTTP session ends after its id has changed (upstream tomcat 9.0.121)
held in a session attribute rather than the live session id, so they are still closed
when the HTTP session ends after its id has changed (upstream tomcat 9.0.121)
References
- https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1788514837.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-73180 Vendor Advisory
Timeline
Published4 Sep 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1788514837 · OSV
Track software like this
Free during beta