Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-08-25 | 2 | Disclosure1General1 |
| 2026-08-26 | 1 | Disclosure1 |
CVE-2026-73180 Insufficient Session Expiration in Apache Tomcat Affects WebSocket Sessions https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-73180
Post summary
The post announces CVE-2026-73180, describing an insufficient session expiration bug in Tomcat WebSocket sessions, without providing PoC, exploit, or patch details.
🚨*CVE* CVE-2026-73180 Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection… https://www.cve.org/CVERecord?id=CVE-2026-73180 ----- Traducción: CVE-2026-73180 Vul… https://infoflow.cloud`
Post summary
The text announces CVE-2026-73180 with a brief technical description and links to its official CVE record, but provides no exploitation, mitigation, or PoC details.
CVE-2026-73180 Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection… https://www.cve.org/CVERecord?id=CVE-2026-73180
Post summary
The post references CVE-2026-73180 and briefly describes a session expiration issue in Apache Tomcat, but provides no PoC, exploit details, active exploitation claim, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | apache | tomcat | - | - | - |