Amazon Linux 2 (EOS) Security Advisory: ALAS2TOMCAT9-2026-028
Advisory Released Date: 2026-08-31
Advisory Updated Date: 2026-08-31
Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example.
This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue.
Users are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue. (CVE-2026-66299)
Affected Packages:
tomcat
Note:
This advisory is applicable to Amazon Linux 2 - Tomcat9 Extra. Visit this page to learn more about Amazon Linux 2 (AL2) Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update tomcat or yum update --advisory ALAS2TOMCAT9-2026-028 to update your system.
noarch:
tomcat-9.0.121-1.amzn2.0.1.noarch
tomcat-admin-webapps-9.0.121-1.amzn2.0.1.noarch
tomcat-docs-webapp-9.0.121-1.amzn2.0.1.noarch
tomcat-jsvc-9.0.121-1.amzn2.0.1.noarch
tomcat-jsp-2.3-api-9.0.121-1.amzn2.0.1.noarch
tomcat-lib-9.0.121-1.amzn2.0.1.noarch
tomcat-servlet-4.0-api-9.0.121-1.amzn2.0.1.noarch
tomcat-el-3.0-api-9.0.121-1.amzn2.0.1.noarch
tomcat-webapps-9.0.121-1.amzn2.0.1.noarch
src:
tomcat-9.0.121-1.amzn2.0.1.src