WaratekVRT Sign in

CVE-2021-43980 Apache Tomcat

Affected softwareApache Tomcat
Severity3.7 Low CVSS 3.1 2 scores
Fixed in8.5.78, 9.0.62, 10.0.20, 10.1.0-M14
WeaknessCWE-362
Published28 Sep 2022
Updated17 Jun 2026

Description

The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 4 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 2.4% chance in 30 days

Waratek protection

No exploit published

Within Waratek scope. In the sources we check, nobody has published exploit code for this CVE or reported it being exploited.

VRT has not found a public code change for this CVE yet.

  • Protection none
  • Action not pursued
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to No source fix or exploit.

CVSS

3.7 LOW v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 3.7 LOW CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N NVD Primary published
CVSS 3.1 3.7 LOW CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CISA-ADP Secondary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2025 ↗ CPU 2025-Q2 Oracle Autonomous Health Framework / Trace File Analyzer (Apache Tomcat) (23.8.0-23.11.0, 24.1.0-24.11.0, 25.1.0, 25.2.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Autonomous Health Framework Trace File Analyzer (Apache Tomcat) 23.8.0-23.11.0, 24.1.0-24.11.0, 25.1.0, 25.2.0 25.1.0 · 25.2.0

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.apache.tomcat:tomcat 8.5.0 8.5.78 unbounded
org.apache.tomcat:tomcat 9.0.0-M1 9.0.62 unbounded
org.apache.tomcat:tomcat 10.0.0-M1 10.0.20 unbounded
org.apache.tomcat:tomcat 10.1.0-M1 10.1.0-M14 unbounded

Products and versions

3 products, 21 version entries
SourceVendorProductSchemeAffected versions
nvd apache tomcat generic ≥ 8.5.0 and ≤ 8.5.77 · ≥ 9.0.0 and ≤ 9.0.60 · ≥ 10.0.0 and ≤ 10.0.18 · 10.1.0:milestone1 · 10.1.0:milestone10 · 10.1.0:milestone11 · 10.1.0:milestone12 · 10.1.0:milestone2 · 10.1.0:milestone3 · 10.1.0:milestone4 · 10.1.0:milestone5 · 10.1.0:milestone6 · 10.1.0:milestone7 · 10.1.0:milestone8 · 10.1.0:milestone9
nvd debian debian linux generic 10.0 · 11.0
osv org.apache.tomcat tomcat generic ≥ 8.5.0 and ＜ 8.5.78 · ≥ 9.0.0 and ＜ 9.0.62 · ≥ 10.0.0 and ＜ 10.0.20 · ≥ 10.1.0 and ＜ 10.1.0

References

URLTags
https://github.com/apache/tomcat/commit/170e0f792bd18ff031677890ba2fe50eb7a376c1 WEB
https://github.com/apache/tomcat/commit/17f177eeb7df5938f67ef9ea580411b120195f13 WEB
https://github.com/apache/tomcat/commit/4a00b0c0890538b9d3107eef8f2e0afadd119beb WEB
https://github.com/apache/tomcat/commit/9651b83a1d04583791525e5f0c4c9089f678d9fc WEB
https://github.com/apache/tomcat PACKAGE
https://lists.apache.org/thread/3jjqbsp6j88b198x5rmg99b1qr8ht3g3 WEB
https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html WEB
https://tomcat.apache.org/security-10.html WEB
https://tomcat.apache.org/security-8.html WEB
https://tomcat.apache.org/security-9.html WEB

Timeline
Published2022-09-28By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.