Knowledge Base Articles
Knowledge Base Articles
Breadcrumbs

Is Tempo Timesheets Data Center affected by the Apache Tomcat vulnerabilities (CVE-2026-79677, CVE-2026-77791, CVE-2026-76183)?

Question

Is Tempo Timesheets for Jira Data Center affected by the Apache Tomcat vulnerabilities CVE-2026-79677, CVE-2026-77791, and CVE-2026-76183? In particular, does it define or enable any WebSocket (JSR 356) endpoints?

Answer

No. Tempo Timesheets doesn't bundle or embed Tomcat. The Tomcat runtime is provided by the Jira host, so exposure to these vulnerabilities depends on the Tomcat version that ships with your Jira version, not on Tempo.

Our development team reviewed Tempo Timesheets 18.7.0 and confirmed that it:

  • Doesn't define, register, or enable any WebSocket (JSR 356) endpoints.

  • Contains no @ServerEndpoint classes and no WebSocket libraries.

  • Doesn't perform protocol upgrades.

As a result, Tempo adds no WebSocket attack surface relevant to CVE-2026-79677. To assess your exposure to these vulnerabilities, please check the Tomcat version bundled with your Jira version and follow Atlassian's guidance.