8.6

CVE-2022-25762: apache software foundation apache tomcat Improper Resource Shutdown or Release

CVSS: 8.6v3.1HighModified
AliasesUBUNTU-CVE-2022-25762DEBIAN-CVE-2022-25762GHSA-h3ch-5pp2-vh6w
Published 13-05-2022Last modified 08-10-2026
Open JSON

Vulnerability summary

CVE-2022-25762 is a high (CVSS 8.6) Improper Resource Shutdown or Release vulnerability in apache software foundation apache tomcat. EPSS estimates a 8.40% chance of exploitation in the next 30 days, higher than 94.9% of scored vulnerabilities.

Overall risk
36/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.6/10
010
High · v3.1 (NVD)
EPSS score
8.40%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1
RHSA-2020:4847

Timeline

  1. 13-05-2022
    PublishedVulnerability first disclosed.
  2. 08-10-2026
    Last modifiedVulnerability information updated.

Description

If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

8.40%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

0.00 pp

From 8.40% on 18-09-2026

18-09-202618-10-2026
EPSS score
8.40%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu2 products
  • tomcat8All versions (No fix recorded)
  • tomcat9All versions (No fix recorded)
Apache1 product
  • tomcat≥ 8.5.0, < 8.5.76 | ≥ 9.0.0, < 9.0.21
Apache software foundation1 product
  • apache tomcatApache Tomcat 9 9.0.0.M1 to 9.0.20 | Apache Tomcat 8.5 8.5.0 to 8.5.75
Debian1 product
  • tomcat9< 9.0.22-1
Oracle1 product
Org.apache.tomcat1 product
  • tomcat≥ 8.5.0, < 8.5.75 | ≥ 9.0.0M1, < 9.0.20

6 vendors · 7 products

References

14 links
Show all 14 references