This vulnerability represents uncontrolled resource consumption in the WebSocket chat example shipped with Apache Tomcat. An attacker can cause the server to allocate excessive memory or CPU resources by sending specially crafted WebSocket traffic, leading to a denial‑of‑service condition that disrupts availability for legitimate users. The weakness aligns with CWE‑400, Resource Exhaustion.

The flaw appears in several Tomcat releases: 11.0.0‑M20 through 11.0.24, 10.1.24 through 10.1.57, and 9.0.89 through 9.0.120. Hosts that have removed the embedded examples web application are not vulnerable. Users running those ranges should update or decommission the examples app.

The CVSS score of 7.5 indicates a high severity. The EPSS score is less than 1 %, suggesting a low current exploitation likelihood, and the vulnerability is not listed in CISA KEV. However, the attack vector is inferred to be remote, via the WebSocket endpoint provided by the example application, and any entity capable of establishing WebSocket connections can trigger the resource drain.