Insufficient Session Expiration in Apache Tomcat - CVE-2026-73180
Published: August 26, 2026
Vulnerability identifier: #VU145388
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-73180
CWE-ID: CWE-613
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to maintain an authenticated websocket session after the associated http session has ended.
The vulnerability exists due to improper session management in the websocket session handling when the session id of an authenticated http session is changed after a websocket connection has been established. A remote user can continue using the websocket connection to maintain an authenticated websocket session after the associated http session has ended.
The issue occurs only if the session id for the authenticated http session is changed after the websocket connection has already been established.
Affected software
Apache Tomcat
How to mitigate CVE-2026-73180
Install security update from vendor's website.
Apache Tomcat - addressed in versions 9.0.121, 10.1.59, 11.0.25