Secuno
ENNL
Book demo

CVE-2022-25762

Apache Tomcat vulnerability

8.6 HIGHEPSS 8.40%
  1. Published13 May 2022

Description

If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityLow
AvailabilityLow
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Affected products

Apache Tomcat≥ 8.5.0 < 8.5.76 · ≥ 9.0.0 < 9.0.21
Oracle Agile Product Lifecycle Management9.3.6

Remediation

Fixed in
Apache Tomcat≥ 8.5.76

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-418699.1
Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in…
CVE-2025-58678.0
A vulnerability classified as critical was found in RT-Thread 5.1.0. This vulnerability…
CVE-2019-17088.6
A vulnerability in the Internet Key Exchange Version 2 Mobility and Multihoming…

Frequently asked

Is CVE-2022-25762 being actively exploited?

CVE-2022-25762 is not in the CISA KEV catalog. Its EPSS exploit probability is 8.40%.

How severe is CVE-2022-25762?

CVE-2022-25762 has a CVSS 3.1 base score of 8.6, rated high. EPSS estimates a 8.40% probability of exploitation.

Which products are affected by CVE-2022-25762?

Affected products include Apache Tomcat, Oracle Agile Product Lifecycle Management.

How do I fix CVE-2022-25762?

Upgrade affected software to a fixed version, for example Apache Tomcat 8.5.76 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2022-25762 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.