CVE-2026-87022

HighCVSS 7.5/10Last modified Sep 23, 2026

Description

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121.

The following versions were EOS at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.56 through 7.0.109. Other unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.1.22, which fix the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-130

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 23, 2026
Last modified: Sep 23, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-870238.5Tanium addressed a path traversal vulnerability in Comply.CVE-2026-870247.2Tanium addressed a SQL injection vulnerability in Asset.CVE-2026-870255.4Tanium addressed an improper access controls vulnerability in Comply.CVE-2026-870263.8Tanium addressed an improper access controls vulnerability in Threat Response.CVE-2026-870286.5Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board i CVE-2026-870297.5undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forward CVE-2026-87036.4The Endless Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and inc CVE-2026-870308.5Tanium addressed a path traversal vulnerability in Comply.CVE-2026-870312.7n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint (POST /ccm/api/1.0/users, the add() method of concrete/src/Api/Contr CVE-2026-870324.3Tanium addressed an information disclosure vulnerability in Tanium Server.CVE-2026-870335.4Tanium addressed an improper access controls vulnerability in Comply.CVE-2026-870348.3Tanium addressed a SQL injection vulnerability in Comply.