Re: [SECURITY] CVE-2026-66299 Apache Tomcat - DoS via WebSocket chat example

On 28/07/2026 15:26, Mark Thomas wrote:
> CVE-2026-66299 Apache Tomcat - DoS via WebSocket chat example

<snip/>

The majority of the subscribers here aren't part of the Tomcat security 
team so we wanted to make everyone aware of some of the discussions the 
security team had about this issue.

Given that this issue shouldn't affect anyone (everyone has followed the 
advice to remove the examples web application for production - right?), 
we wanted to use this as an experiment to see how the community reacted 
to us publishing a CVE that they should not be impacted by when they 
can't currently obtain a release with a fix for the CVE.

One of the ideas floated in various OSS projects to help manage the 
flood of AI generated vulnerability reports - particularly where it is 
highly unlikely any users will be affected - is to fix and publish 
without a release. The purpose of this experiment is to see what that 
might look like for the Tomcat community.

Mark