CVE catalog
CVE-2022-25762
If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that
- Severity
- High · CVSS 8.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 8.40% · Oct 25, 2026
If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | tomcat9 | sid | 9.0.122-1 | fixed |
| Debian | tomcat9 | forky | 9.0.122-1 | fixed |
| Debian | tomcat9 | trixie | 9.0.95-1 | fixed |
| Debian | tomcat9 | bookworm | 9.0.70-2 | fixed |
| Cpe | tomcat | Not reported | 9.0.21 | fixed |
| Cpe | agile_product_lifecycle_management | Not reported | Not reported | unknown |
| Ubuntu | tomcat8 | pro | 8.5.21-1ubuntu1 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.29-1 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.30-1 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.30-1ubuntu1 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.30-1ubuntu1.2 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.30-1ubuntu1.3 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.30-1ubuntu1.4 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.39-1ubuntu1~18.04.1 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.39-1ubuntu1~18.04.2 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.39-1ubuntu1~18.04.3 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.39-1ubuntu1~18.04.3+esm1 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.39-1ubuntu1~18.04.3+esm2 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.39-1ubuntu1~18.04.3+esm3 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.39-1ubuntu1~18.04.3+esm4 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.39-1ubuntu1~18.04.3+esm5 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.39-1ubuntu1~18.04.3+esm6 | vulnerable |
| Ubuntu | tomcat9 | pro | 9.0.16-3~18.04.1 | vulnerable |
| Ubuntu | tomcat9 | pro | 9.0.16-3ubuntu0.18.04.1 | vulnerable |
| Ubuntu | tomcat9 | pro | 9.0.16-3ubuntu0.18.04.2 | vulnerable |
| Ubuntu | tomcat9 | pro | 9.0.16-3ubuntu0.18.04.2+esm1 | vulnerable |
| Ubuntu | tomcat9 | pro | 9.0.16-3ubuntu0.18.04.2+esm2 | vulnerable |
| Ubuntu | tomcat9 | pro | 9.0.16-3ubuntu0.18.04.2+esm3 | vulnerable |
| Ubuntu | tomcat9 | pro | 9.0.16-3ubuntu0.18.04.2+esm4 | vulnerable |
| Ubuntu | tomcat9 | pro | 9.0.16-3ubuntu0.18.04.2+esm5 | vulnerable |
| Ubuntu | tomcat9 | pro | 9.0.16-3ubuntu0.18.04.2+esm6 | vulnerable |
| Ubuntu | tomcat9 | pro | 9.0.16-3ubuntu0.18.04.2+esm7 | vulnerable |
| Ubuntu | tomcat9 | pro | 9.0.16-3ubuntu0.18.04.2+esm8 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | tomcat9 | source | sid | 9.0.22-1 | not yet assigned | Not reported | Not reported |
| Debian | tomcat9 | source | forky | 9.0.22-1 | not yet assigned | Not reported | Not reported |
| Debian | tomcat9 | source | trixie | 9.0.22-1 | not yet assigned | Not reported | Not reported |
| Debian | tomcat9 | source | bookworm | 9.0.22-1 | not yet assigned | Not reported | Not reported |
| Cpe | tomcat | cpe | Not reported | 9.0.21 | Not reported | NVD-CVE-2022-25762 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libtomcat9-java]Fixed
Source package: [tomcat9]
Details (2)
9.0.70-2· all · bookwormFixed · Fixed:
9.0.22-1nvd · tomcat9 · debian · bookworm; nvd · tomcat9 · debian · 12
9.0.70-2· all · bookwormFixed · Fixed:
9.0.22-1nvd · tomcat9 · debian · bookworm; nvd · tomcat9 · debian · 12
[Debian 13 (Trixie)]
- [libtomcat9-java]Fixed
Source package: [tomcat9]
Details (2)
9.0.95-1· all · trixieFixed · Fixed:
9.0.22-1nvd · tomcat9 · debian · 13
9.0.95-1· all · trixieFixed · Fixed:
9.0.22-1nvd · tomcat9 · debian · 13
Observed:
References
- [https://nvd.nist.gov/vuln/detail/CVE-2022-25762]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2022-25762]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2022-25762]
- [https://security-tracker.debian.org/tracker/CVE-2022-25762]
- [https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-25762.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-1335.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]