Improper handling of the length parameter when per‑message‑deflate compression is enabled in Apache Tomcat can lead to WebSocket message smuggling. The flaw arises from an inconsistency in how the length field of a compressed message is interpreted, allowing an attacker to craft a payload that causes the server to process more data than expected. This can result in the injection of arbitrary data into subsequent frames or the exhaustion of server resources. The weakness corresponds to CWE‑130.

Affected versions include Apache Tomcat 8.5.0 through 8.5.100, 7.0.56 through 7.0.109, and all supported releases from 9.0.0.M1 to 9.0.121, 10.1.0.M1 to 10.1.59, and 11.0.0‑M1 to 11.0.25. The end‑of‑support versions mentioned are no longer maintained, but their use still poses a risk. Other unsupported Tomcat releases may also be vulnerable if they contain the affected WebSocket handling code.

Because EPSS data is unavailable, the exploitation likelihood cannot be quantified, but the lack of a KEV listing does not mitigate the potential for abuse. The CVSS score of 7.5 indicates a high severity, yet the mechanism provides a path for remote attackers to send mal‑crafted WebSocket frames that may bypass input validation or exhaust server resources. The attack vector is remote, requiring a reachable WebSocket endpoint with per‑message‑deflate enabled. The risk is assessed as high due to the potential for unauthorized data injection and denial of service.