Apache Tomcat processes WebSocket close messages in a manner that can cause the server to enter a busy wait loop, consuming CPU time and memory. This results in a denial of service condition that degrades or stops legitimate traffic, impacting availability of applications that rely on WebSocket endpoints. The vulnerability is a CWE‑400 Uncontrolled Resource Consumption flaw.

The flaw affects Apache Tomcat versions 11.0.0‑M5 through 11.0.25, 10.1.8 through 10.1.59, and 9.0.74 through 9.0.121. EOL releases from 8.5.88 to 8.5.100 are also known to be affected, and other unsupported releases may be vulnerable.

A remote attacker who can send WebSocket close frames to an affected Tomcat instance can trigger the busy wait loop and cause service disruption. The CVSS score of 7.5 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the KEV catalog, so the exact likelihood of use in the wild remains unknown. The impact is a loss of availability for any client relying on the WebSocket endpoint.