---
id: CVE-2022-25762
title: >-
  If a web application sends a WebSocket message concurrently with the WebSocket
  connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache
  Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue
  to use…
summary: >-
  If a web application sends a WebSocket message concurrently with the WebSocket
  connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache
  Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue
  to use…
severity: high
cvss: 8.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L'
cwe:
  - CWE-404
  - CWE-404
vendor: apache
product: tomcat
affected:
  - 'tomcat >= 8.5.0, < 8.5.76'
  - 'tomcat >= 9.0.0, < 9.0.21'
  - agile_product_lifecycle_management = 9.3.6
patched:
  - tomcat 9.0.21
published: '2022-05-13'
updated: '2026-08-25'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-25762'
references:
  - url: 'https://lists.apache.org/thread/6ckmjfb1k61dyzkto9vm2k5jvt4o7w7c'
    label: security@apache.org
  - url: 'https://security.netapp.com/advisory/ntap-20220629-0003/'
    label: security@apache.org
  - url: 'https://www.oracle.com/security-alerts/cpujul2022.html'
    label: security@apache.org
  - url: 'https://lists.apache.org/thread/6ckmjfb1k61dyzkto9vm2k5jvt4o7w7c'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20220629-0003/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.oracle.com/security-alerts/cpujul2022.html'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.08405
epssPercentile: 0.94809
ingestedAt: '2026-08-25T17:29:31.973Z'
---

## Overview

If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.

## Affected

- `tomcat >= 8.5.0, < 8.5.76`
- `tomcat >= 9.0.0, < 9.0.21`
- `agile_product_lifecycle_management = 9.3.6`

## Remediation

Upgrade past the affected range:

- `tomcat 9.0.21`