[GHSA-fv25-8xcx-gqjc] Apache Tomcat - WebSocket authentication header exposure

[levpachmanov]

Updates

• Affected products

Comments

Why GHSA-fv25-8xcx-gqjc points at the wrong packages

CVE-2026-42498 is a bug in Tomcat's WebSocket client: after an authenticated
WebSocket request is redirected, the client re-sends the Authorization header to
the redirect target. The vulnerable code lives entirely in the Java package
org.apache.tomcat.websocket.

Tomcat ships that package in its own JARs. build.xml defines:

• files.tomcat-websocket = org/apache/tomcat/websocket/** → tomcat-websocket.jar
  and (with the WebSocket API) tomcat-embed-websocket.jar
• files.tomcat-embed-core = catalina, servlet-api, jaspic-api, tomcat-api, juli,
  org/apache/coyote/**, org/apache/tomcat/jni/**, org/apache/tomcat/util/**
• files.catalina (→ tomcat-catalina.jar) = org/apache/catalina/** + org/apache/naming/**

Neither of the last two includes org/apache/tomcat/websocket/**, and the three
upstream fix commits (169d7257, 6cbe2745, b7b17369) touch nothing outside it.
Unzipping the 9.0.117 artifacts confirms it:

Artifact	org/apache/tomcat/websocket/ entries
org.apache.tomcat.embed:tomcat-embed-core	0
org.apache.tomcat:tomcat-catalina	0
org.apache.tomcat.embed:tomcat-embed-websocket	130
org.apache.tomcat:tomcat-websocket	133

So the advisory is wrong in both directions:

• False positive — everyone depending on tomcat-embed-core or tomcat-catalina
  is told to upgrade for code they don't ship.
• False negative — tomcat-websocket and tomcat-embed-websocket are separately
  resolved Maven artifacts, so projects that actually carry the vulnerable client get
  no alert at all.

org.apache.tomcat:tomcat stays affected: it's the full binary distribution
(tomcat-<version>.tar.gz / .zip), which bundles lib/tomcat-websocket.jar.