Disclosure summary
If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.
Source-reported weakness categories
CWE-404
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2022-25762
Open original source · Updated Oct 08, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| apache | tomcat | * {"versionStartIncluding":"9.0.0","versionEndExcluding":"9.0.21"} |
| oracle | agile_product_lifecycle_management | 9.3.6 |
Original records & references
- NIST NVD record
- CVE Program record
- lists.apache.org — Mailing List, Vendor Advisory
- security.netapp.com — Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
- lists.apache.org — Mailing List, Vendor Advisory
- security.netapp.com — Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
PUBLISHED 2022-05-13T04:15:06-04:00
MODIFIED 2026-10-08T18:17:19-04:00
INGESTED 2026-10-10T20:50:21-04:00