High severity · published May 13, 2022
CVE-2022-25762
Response mix-up with WebSocket concurrent send and close
8.6
CVSS
8.4%
EPSS
No
On KEV
Description
If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)8.4% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TO
Tomcat · Apache
Apache Tomcat 9 9.0.0.M1 to 9.0.20; Apache Tomcat 8.5 8.5.0 to 8.5.75 · source: vendor, NVD
AP
Agile Product Lifecycle Management · Oracle
9.3.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-25762
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-25762
Mailing List
https://lists.apache.org/thread/6ckmjfb1k61dyzkto9vm2k5jvt4o7w7c
Third Party Advisory
https://security.netapp.com/advisory/ntap-20220629-0003/
Patch
https://www.oracle.com/security-alerts/cpujul2022.html
More from Tomcat
9.8
CVE-2025-24813
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
9.8
CVE-2020-1938
Apache Tomcat Improper Privilege Management Vulnerability
9.8
CVE-2016-8735
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if…
8.1
CVE-2017-12617
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g
8.1
CVE-2017-12615
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g