Search: CVE-2026-73180

CVE-2026-73180 is an Insufficient Session Expiration vulnerability in Apache Tomcat affecting multiple versions. The issue occurs when a session ID for an authenticated HTTP session changes after a WebSocket connection is established; the WebSocket session does not close as required when the HTTP session ends. This affects Apache Tomcat versions from 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.0.M1 through 9.0.120, as well as some older EOL versions. Users are advised to upgrade to fixed versions 11.0.25, 10.1.58, or 9.0.121.