CVE-2022-25762

HighCVSS 8.6/10Last modified Oct 8, 2026

Description

If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-404

Affected software

No affected versions have been published.

Timeline

Published: May 13, 2022
Last modified: Oct 8, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-257637.5Improper Input Validation vulnerability in HTTP/2 request validation of Apache Traffic Server allows an attacker to create smuggle or cache CVE-2022-257659.8The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized.CVE-2022-257668.8The package ungit before 1.5.20 are vulnerable to Remote Code Execution (RCE) via argument injection. The issue occurs when calling the /api CVE-2022-257679.8All versions of package com.bstek.ureport:ureport2-console are vulnerable to Remote Code Execution by connecting to a malicious database ser CVE-2022-257686.5The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform th CVE-2022-257699.1ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the roo CVE-2022-25778.8A vulnerability classified as critical was found in SourceCodester Garage Management System 1.0. This vulnerability affects unknown code of CVE-2022-257707.5Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off correctly, which may lead to vulner CVE-2022-257726.1A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable CVE-2022-257735.4This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server. * CVE-2022-257745.4Prior to the patched version, logged in users of Mautic are vulnerable to a self XSS vulnerability in the notifications within Mautic. User CVE-2022-257757.2Prior to the patched version, logged in users of Mautic are vulnerable to an SQL injection vulnerability in the Reports bundle. The user co