CVE-2021-30639
DoS after non-blocking IO error
A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS. Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS. Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.
- Record
CVE-2021-30639- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-755
- Updated
- 2026-11-02
CVE List No score
DoS after non-blocking IO error
A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS. Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.
- Record
CVE-2021-30639- Updated
- 2026-11-02
EUVDEUVD-2021-1554 No score
A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS. Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.
- Record
EUVD-2021-1554- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-44qp-qhfv-c7f6
Improper Handling of Exceptional Conditions in Apache Tomcat
A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS. Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.
- Record
GHSA-44qp-qhfv-c7f6- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-755
- Updated
- 2026-11-02
OSV
A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS. Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.
- Record
CVE-2021-30639- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-44qp-qhfv-c7f6
Improper Handling of Exceptional Conditions in Apache Tomcat
A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS. Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.
- Record
GHSA-44qp-qhfv-c7f6- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-755
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-30639
A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS. Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.
- Record
UBUNTU-CVE-2021-30639- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-tomcat-2021-30639 No score
DoS after non-blocking IO error
A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS. Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.
- Record
BIT-tomcat-2021-30639- Updated
- 2026-11-02
OSVCLSA-2025-1748282295 No score
Fix of 34 CVEs
- SECURITY UPDATE: Misc vulnerability fixes
- CVE-2019-12418, CVE-2019-17563, CVE-2020-1935, CVE-2020-11996, CVE-2020-13934, CVE-2020-13935, CVE-2020-13943, CVE-2020-17527, CVE-2021-24122, CVE-2021-30639, CVE-2021-30640, CVE-2021-33037, CVE-2021-42340, CVE-2021-43980, CVE-2022-25762, CVE-2022-34305, CVE-2022-45143, CVE-2023-24998, CVE-2023-28709, CVE-2023-34981, CVE-2023-42794, CVE-2024-21733
- Update to 8.5.100
- debian/rules, debian/libtomcat8-java.poms, debian/maven.rules, debian/tomcat8-common.links, debian/patches/0018-fix-manager-webapp.patch, debian/patches/0019-add-distribution-to-error-page.patch, debian/patches/0021-dont-test-unsupported-ciphers.patch, debian/patches/0101-skipping-tests-incompatible-with-firewall.patch: updated
- debian/patches/0002-do-not-load-AJP13-connector-by-default.patch, debian/patches/0026-easymock4-compatibility.patch: removed as they were applied in upstream
- CVE-2019-0221.patch, CVE-2019-10072-1.patch, CVE-2019-10072-2.patch, CVE-2022-42252.patch, CVE-2020-1938.patch, CVE-2021-25122.patch, CVE-2021-41079.patch, CVE-2022-29885.patch, CVE-2020-9484.patch, CVE-2021-25329-pre1.patch, CVE-2021-25329.patch, CVE-2022-23181.patch, CVE-2023-44487.patch, CVE-2023-46589-pre1.patch, CVE-2023-46589-pre2.patch, CVE-2023-46589-pre3.patch, CVE-2023-46589-pre4.patch, CVE-2023-46589.patch: removed because these CVEs were fixed in upstream
- Internal tests
- debian/test_certs/*: updated from upstream branch 9.0.x, as the 8.0.x certs were expired
- Record
CLSA-2025-1748282295- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven |
10.0.3 up to 10.0.5 | 10.0.5 |
org.apache.tomcat:tomcatMaven |
9.0.0 up to 9.0.45 | 9.0.45 |
org.apache.tomcat:tomcatMaven |
before 8.5.65 | 8.5.65 |
tomcatBitnami |
8.5.64 up to 8.5.65, 9.0.44 up to 9.0.45, 10.0.3 up to 10.0.4, 10.0.4 up to 10.0.5 | 8.5.659.0.4510.0.410.0.5 |
libtomcat8-embed-javaTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
libtomcat8-javaTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
tomcat8TuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
tomcat8-adminTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
tomcat8-commonTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
tomcat8-docsTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tomcat8-examplesTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
tomcat8-userTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
org.apache.tomcat:tomcatMaven |
10.0.3 up to 10.0.5, plus listed versions 10.0.4 |
10.0.5 |
org.apache.tomcat:tomcatMaven |
9.0.0 up to 9.0.45, plus listed versions 9.0.19.0.109.0.119.0.129.0.13 Show 30 moreShow less9.0.149.0.169.0.179.0.199.0.29.0.209.0.219.0.229.0.249.0.269.0.279.0.299.0.309.0.319.0.339.0.349.0.359.0.369.0.379.0.389.0.399.0.49.0.409.0.419.0.439.0.449.0.59.0.69.0.79.0.8 |
9.0.45 |
org.apache.tomcat:tomcatMaven |
before 8.5.65, plus listed versions 7.0.1007.0.1037.0.1047.0.1057.0.106 Show 45 moreShow less7.0.1077.0.1087.0.1097.0.357.0.377.0.397.0.407.0.417.0.427.0.477.0.507.0.527.0.537.0.547.0.557.0.567.0.577.0.597.0.617.0.627.0.637.0.647.0.657.0.677.0.687.0.697.0.707.0.727.0.737.0.757.0.767.0.777.0.787.0.797.0.817.0.827.0.847.0.857.0.867.0.887.0.907.0.917.0.927.0.937.0.94 |
8.5.65 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-30639 is a high vulnerability (CVSS 7.5) in Apache Tomcat, published July 12, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.89%, the 94th percentile. Fixed in org.apache.tomcat:tomcat 10.0.5.
References
lists.apache.org/thread.html/rd84fae1f474597bdf358f5bdc0a5c453c507bd527b83e8be6b5ea3f4%40%3Cannounce.tomcat.apache.org%3E
security.netapp.com/advisory/ntap-20210827-0007
kc.mcafee.com/corporate/index?page=content&id=SB10366
oracle.com/security-alerts/cpujan2022.html
Show 11 moreShow less
security.gentoo.org/glsa/202208-34
nvd.nist.gov/vuln/detail/CVE-2021-30639
github.com/advisories/GHSA-44qp-qhfv-c7f6
errata.cloudlinux.com/ubuntu18-els/CLSA-2025-1748282295.html
ubuntu.com/security/CVE-2021-30639
bz.apache.org/bugzilla/show_bug.cgi?id=65203
cve.org/CVERecord?id=CVE-2021-30639
Left out here: 99 versions. The JSON record has them.