CVE-2021-42340 Apache Tomcat
| Affected software | Apache Tomcat |
|---|---|
| Severity | 7.5 High CVSS 3.1 2 scores |
| Fixed in | 10.1.0-M6, 10.0.12, 9.0.54, 8.5.72 |
| Weakness | CWE-772 |
| Published | 14 Oct 2021 |
| Updated | 17 Jun 2026 |
Description
The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.
Exploitation status
No public exploit
No exploit has been reported in the sources we check. Published 5 years ago.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment no assessment published
- Indexed PoC none indexed
- EPSS 12% chance in 30 days A model's forecast, not a report of exploitation. Higher than 96% of all scored CVEs.
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full
- Action available security rule
- Review human Researcher
- Record active
| Decided by | Manual classification of this CVE in the legacy dataset |
|---|---|
| Finding | A manual classification set this CVE's status to Protected by Waratek. |
How to mitigate CVE-2021-42340
Upgrade Apache Tomcat to a release that fixes it: 10.1.0-M6, 10.0.12, 9.0.54 or 8.5.72. Until you can, Waratek RASP blocks exploitation with a security rule that blocks this kind of attack. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
7.5 HIGH
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
2 metrics
CVSS
7.5 HIGH v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
NVD | Primary | published |
| CVSS 2.0 | 5.0 | none | AV:N/AC:L/Au:N/C:N/I:N/A:P |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update July 2022 ↗ | CPU | 2022-Q3 | Oracle Big Data Graph / Big Data Graph (Apache Tomcat) (Prior to 23.1) Oracle Fusion Middleware / MFT Runtime Server (Apache Tomcat) (12.2.1.3.0, 12.2.1.4.0) Oracle Supply Chain / Installation Issues (Apache Tomcat) (6.2.1.0) |
| Oracle Critical Patch Update April 2022 ↗ | CPU | 2022-Q2 | Oracle Commerce / Content Acquisition System (Apache Tomcat) (11.3.2) Oracle Communications / General (Apache Tomcat) (Prior to 9.0) Oracle Communications / SCP (Apache Tomcat) (1.15.0) Oracle Communications / Security (Apache Tomcat) (Prior to 1.5.0) Oracle Communications / Security (Apache Tomcat) (Prior to 9.0) Oracle Communications / Third Party (Apache Tomcat) (Prior to 9.0) Oracle Communications Applications / DBPlugin (Apache Tomcat) (10.0.1.5.0) Oracle MySQL / Monitoring: General (Apache Tomcat) (8.0.29 and prior) Oracle Supply Chain / Security (Apache Tomcat) (9.3.6) |
| Oracle Critical Patch Update January 2022 ↗ | CPU | 2022-Q1 | Oracle Communications / Management (Apache Tomcat) (9.0, 9.1) Oracle Communications / Platform (Apache Tomcat) (8.0.0.0-8.5.0.2) Oracle Hospitality Applications / Next-Gen SPMS (Apache Tomcat) (20.1.0) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Big Data Graph | Big Data Graph (Apache Tomcat) | Prior to 23.1 | |
| Oracle Commerce | Content Acquisition System (Apache Tomcat) | 11.3.2 | 11.3.2 |
| Oracle Communications | General (Apache Tomcat) | Prior to 9.0 | |
| Oracle Communications | Management (Apache Tomcat) | 9.0, 9.1 | 9.0 · 9.1 |
| Oracle Communications | Platform (Apache Tomcat) | 8.0.0.0-8.5.0.2 | |
| Oracle Communications | SCP (Apache Tomcat) | 1.15.0 | 1.15.0 |
| Oracle Communications | Security (Apache Tomcat) | Prior to 1.5.0 | |
| Oracle Communications | Third Party (Apache Tomcat) | Prior to 9.0 | |
| Oracle Communications Applications | DBPlugin (Apache Tomcat) | 10.0.1.5.0 | 10.0.1.5.0 |
| Oracle Fusion Middleware | MFT Runtime Server (Apache Tomcat) | 12.2.1.3.0, 12.2.1.4.0 | 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle Hospitality Applications | Next-Gen SPMS (Apache Tomcat) | 20.1.0 | 20.1.0 |
| Oracle MySQL | Monitoring: General (Apache Tomcat) | 8.0.29 and prior | |
| Oracle Supply Chain | Installation Issues (Apache Tomcat) | 6.2.1.0 | 6.2.1.0 |
| Oracle Supply Chain | Security (Apache Tomcat) | 9.3.6 | 9.3.6 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.tomcat:tomcat |
10.1.0-M1 | 10.1.0-M6 |
unbounded |
org.apache.tomcat:tomcat |
10.0.0-M1 | 10.0.12 |
unbounded |
org.apache.tomcat:tomcat |
9.0.40 | 9.0.54 |
unbounded |
org.apache.tomcat:tomcat |
8.5.60 | 8.5.72 |
unbounded |
Products and versions
19 products, 41 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | tomcat | generic | ≥ 8.5.60 and ＜ 8.5.72 · ≥ 9.0.40 and ＜ 9.0.54 · 10.0.0:milestone10 · ≥ 10.0.1 and ＜ 10.0.12 · 10.1.0:milestone1 · 10.1.0:milestone2 · 10.1.0:milestone3 · 10.1.0:milestone4 · 10.1.0:milestone5 |
| nvd | debian | debian linux | generic | 11.0 |
| nvd | netapp | hci | generic | any version |
| nvd | netapp | management services for element software | generic | any version |
| nvd | oracle | agile engineering data management | generic | 6.2.1.0 |
| nvd | oracle | big data spatial and graph | generic | ＜ 23.1 |
| nvd | oracle | communications diameter signaling router | generic | ≥ 8.0.0.0 and ≤ 8.5.0.2 |
| nvd | oracle | hospitality cruise shipboard property management system | generic | 20.1.0 |
| nvd | oracle | managed file transfer | generic | 12.2.1.3.0 · 12.2.1.4.0 |
| nvd | oracle | middleware common libraries and tools | generic | 12.2.1.4.0 |
| nvd | oracle | payment interface | generic | 19.1 · 20.3 |
| nvd | oracle | retail customer insights | generic | 15.0.2 · 16.0.2 |
| nvd | oracle | retail data extractor for merchandising | generic | 15.0.2 · 16.0.2 |
| nvd | oracle | retail eftlink | generic | 21.0.0 |
| nvd | oracle | retail financial integration | generic | 16.0.1 · 19.0.0 |
| nvd | oracle | retail store inventory management | generic | 14.0.4.13 · 14.1.3.5 · 14.1.3.14 · 15.0.3.3 · 15.0.3.8 · 16.0.3.7 |
| nvd | oracle | sd-wan edge | generic | 9.0 · 9.1 |
| nvd | oracle | taleo platform | generic | any version |
| osv | org.apache.tomcat | tomcat | generic | ≥ 8.5.60 and ＜ 8.5.72 · ≥ 9.0.40 and ＜ 9.0.54 · ≥ 10.0.0 and ＜ 10.0.12 · ≥ 10.1.0 and ＜ 10.1.0 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** HTTP, MANAGEMENT (APACHE TOMCAT), PLATFORM (APACHE TOMCAT), NEXT-GEN SPMS (APACHE TOMCAT), NO AUTH REMOTE EXPLOIT **Products:** ORACLE HOSPITALITY CRUISE SHIPBOARD PROPERTY MANAGEMENT SYSTEM, ORACLE SD-WAN EDGE, ORACLE HOSPITALITY APPLICATIONS, ORACLE COMMUNICATIONS DIAMETER SIGNALING ROUTER, ORACLE COMMUNICATIONS
References
Timeline
Timeline
| Published | 2021-10-14 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |