CVE-2026-66299

Apache Tomcat: DoS via WebSocket chat example

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue. Users are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue.

We have discovered 1,657 live websites that are affected by CVE-2026-66299.

Run a Free Instant Scan



Affected Software

Product  Apache Tomcat
Category Web Servers
Vulnerable Domains1,657 live websites (21% of Apache Tomcat install base)
Vulnerable Versions
  • from 9.0.89 through 9.0.120
  • from 10.1.24 through 10.1.57
  • from 11 through 11.0.24
Vulnerable Versions Count70 versions ( 18% of all versions)


Common Weakness Enumeration

CWE-400 Uncontrolled Resource Consumption



Details

  • Published - Jul 28, 2026
  • Updated - Jul 28, 2026

Credits

  • 4ra1n, pyn3rd and unam4 (finder)

Website Distribution by Country

Number of websites using CVE-2026-66299
United States640 websites


Germany214 websites
China150 websites
France56 websites
Italy52 websites
Canada50 websites
GB45 websites
Netherlands38 websites
Brazil33 websites
India30 websites

Website Distribution by TLD

Number of websites using CVE-2026-66299
.com541 websites
.de176 websites
.edu141 websites
.org83 websites
.net58 websites
.com.br53 websites
.it44 websites
.cn33 websites
.nl28 websites
.ca25 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-66299

Top websites that are affected by CVE-2026-66299. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***.***.edu United States***
**.***.*****.*****.***.com United States**,***
*****.********.com United States**,***
************.com United States**,***
***.*******.com United States**,***
***.*********.edu United States**,***
********.*********.com United States**,***
***.****.edu United States**,***
***.*****.org United States**,***
**********.*********.com United States***,***
See full domain list

FAQ

CVE-2026-66299 is Uncontrolled Resource Consumption in Apache Tomcat
A total of 1,657 websites have been identified as vulnerable to CVE-2026-66299, based on global website indexing conducted by WebTechSurvey.
The Apache Tomcat is affected by the CVE-2026-66299 vulnerability.
Apache Tomcat versions up to and including 11.0.24 are vulnerable to CVE-2026-66299.