Recommended action

Update org.apache.tomcat.embed:tomcat-embed-websocket to 7.0.105; org.apache.tomcat.embed:tomcat-embed-websocket to 8.5.57; org.apache.tomcat.embed:tomcat-embed-websocket to 9.0.37; org.apache.tomcat.embed:tomcat-embed-websocket to 10.0.0-M7; org.apache.tomcat:tomcat to 10.0.0-M7; org.apache.tomcat:tomcat to 9.0.37; org.apache.tomcat:tomcat to 8.5.57; org.apache.tomcat:tomcat to 7.0.105; org.apache.tomcat:tomcat-websocket to 10.0.0-M7; org.apache.tomcat:tomcat-websocket to 9.0.37; org.apache.tomcat:tomcat-websocket to 8.5.57; org.apache.tomcat:tomcat-websocket to 7.0.105 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

Infinite Loop in Apache Tomcat affects org.apache.tomcat.embed:tomcat-embed-websocket (maven), org.apache.tomcat.embed:tomcat-embed-websocket (maven), org.apache.tomcat.embed:tomcat-embed-websocket (maven), org.apache.tomcat.embed:tomcat-embed-websocket (maven), org.apache.tomcat:tomcat (maven), org.apache.tomcat:tomcat (maven), org.apache.tomcat:tomcat (maven), org.apache.tomcat:tomcat (maven), org.apache.tomcat:tomcat-websocket (maven), org.apache.tomcat:tomcat-websocket (maven), org.apache.tomcat:tomcat-websocket (maven), org.apache.tomcat:tomcat-websocket (maven). Severity is high. The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

AI coding agents often install or upgrade packages automatically in maven. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software

Recommended action

Update org.apache.tomcat.embed:tomcat-embed-websocket to 7.0.105; org.apache.tomcat.embed:tomcat-embed-websocket to 8.5.57; org.apache.tomcat.embed:tomcat-embed-websocket to 9.0.37; org.apache.tomcat.embed:tomcat-embed-websocket to 10.0.0-M7; org.apache.tomcat:tomcat to 10.0.0-M7; org.apache.tomcat:tomcat to 9.0.37; org.apache.tomcat:tomcat to 8.5.57; org.apache.tomcat:tomcat to 7.0.105; org.apache.tomcat:tomcat-websocket to 10.0.0-M7; org.apache.tomcat:tomcat-websocket to 9.0.37; org.apache.tomcat:tomcat-websocket to 8.5.57; org.apache.tomcat:tomcat-websocket to 7.0.105 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

Infinite Loop in Apache Tomcat affects org.apache.tomcat.embed:tomcat-embed-websocket (maven), org.apache.tomcat.embed:tomcat-embed-websocket (maven), org.apache.tomcat.embed:tomcat-embed-websocket (maven), org.apache.tomcat.embed:tomcat-embed-websocket (maven), org.apache.tomcat:tomcat (maven), org.apache.tomcat:tomcat (maven), org.apache.tomcat:tomcat (maven), org.apache.tomcat:tomcat (maven), org.apache.tomcat:tomcat-websocket (maven), org.apache.tomcat:tomcat-websocket (maven), org.apache.tomcat:tomcat-websocket (maven), org.apache.tomcat:tomcat-websocket (maven). Severity is high. The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

AI coding agents often install or upgrade packages automatically in maven. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software