p PatchFirst

CVE-2021-42340

CVE-2021-42340 · DoS via memory leak with WebSocket connections

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.

CVSS 7.5 · High · EPSS 11.8% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • apache tomcat

    Versions
    • Apache Tomcat 10 10.0.0-M10 to 10.0.11: Affected
    • Apache Tomcat 10 10.1.0-M1 to 10.1.0-M5: Affected
    • Apache Tomcat 9 9.0.40 to 9.0.53: Affected
    • Apache Tomcat 8 8.5.60 to 8.5.71: Affected

    No fix published

  • tomcat9 Debian:12

    Affected ranges
    • ECOSYSTEM: < 9.0.54-1

    Update to 9.0.54-1

  • tomcat9 Debian:13

    Affected ranges
    • ECOSYSTEM: < 9.0.54-1

    Update to 9.0.54-1

  • tomcat9 Debian:14

    Affected ranges
    • ECOSYSTEM: < 9.0.54-1

    Update to 9.0.54-1

Original sources

Check your server →