Riskcovery

CVE-2022-25762

Response mix-up with WebSocket concurrent send and close

State
Published
Severity
Not scored
Published
May 13, 2022
Updated
Oct 8, 2026
Reserved
Feb 22, 2022

Read the record on cve.org

Description

If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.

Scores

The record has no CVSS score.

Weaknesses

  • CWE-404 Improper Resource Shutdown or Release

Affected Products

ProductVersions
Apache TomcatApache Software Foundation
  • Apache Tomcat 9 9.0.0.M1 to 9.0.20Affected
  • Apache Tomcat 8.5 8.5.0 to 8.5.75Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.