Log in Start free

Vulnerability · Published Oct 14, 2021 · Assigned by apache

CVE-2021-42340DoS via memory leak with WebSocket connections

High 7.5

In plain English

A high-severity security flaw in Apache Tomcat from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 11.8% (higher than 96% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High
Exploit odds (30 days)11.8%top 3.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12tomcat99.0.54-1DEBIAN-CVE-2021-42340
Debian:13tomcat99.0.54-1DEBIAN-CVE-2021-42340
Debian:14tomcat99.0.54-1DEBIAN-CVE-2021-42340
Mavenorg.apache.tomcat:tomcat8.5.72GHSA-wph7-x527-w3h5
Mavenorg.apache.tomcat:tomcat10.1.0-M6GHSA-wph7-x527-w3h5
Mavenorg.apache.tomcat:tomcat10.0.12GHSA-wph7-x527-w3h5
Mavenorg.apache.tomcat:tomcat9.0.54GHSA-wph7-x527-w3h5
Ubuntu:22.04:LTStomcat9no fix listedUBUNTU-CVE-2021-42340
Ubuntu:24.04:LTStomcat9no fix listedUBUNTU-CVE-2021-42340

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Tomcat Apache Tomcat 10 10.0.0-M10 to 10.0.11Apache Tomcat 10 10.1.0-M1 to 10.1.0-M5Apache Tomcat 9 9.0.40 to 9.0.53Apache Tomcat 8 8.5.60 to 8.5.71

Weakness: CWE-772

References