Apache Tomcat contains a flaw where a resource is not released after its effective lifetime, and the logic used to compare timeouts is incorrect. The result is that socket write operations can time out without proper cleanup, causing a buildup of unreleased resources and ultimately driving the server into a state where new WebSocket connections cannot be served. This leads to a denial of service that can be triggered by normal use of the WebSocket API and results in degraded or unavailable service for clients. The weakness is reflected in the CWE‑1025 (Improper Release of Resource) and CWE‑772 (Missing Release of Resource) categories.

Apache Tomcat versions from 11.0.0‑M1 through 11.0.25, from 10.1.0‑M1 through 10.1.59, and from 9.0.0.M1 through 9.0.121 are affected. Earlier end‑of‑life releases from 8.5.0 through 8.5.100 and from 7.0.43 through 7.0.109 are also known to be impacted; additional unsupported releases may be affected as well.

The CVSS score is not provided but the vulnerability allows an attacker to cause a denial of service, which is a high impact issue. EPSS is not available, so the quantitative likelihood is unknown, but the attack does not require privileged access or special environment; a remote user can exploit it by sending WebSocket messages that trigger asynchronous writes. Because the flaw is in the core implementation, any application using Tomcat’s WebSocket support potentially exposes itself. The vulnerability is not listed in the CISA KEV catalog, but it remains a critical risk for availability due to the lack of resource cleanup during slow or stalled connections.