{"id":"CVE-2021-42340","aliases":["BIT-tomcat-2021-42340","CLSA-2025-1748282295","CLSA-2025-1764720465","CLSA-2026-1773188120","CLSA-2026-1792667085","CLSA-2026-1792687381","DEBIAN-CVE-2021-42340","DSA-5009-1","EUVD-2021-2266","GHSA-wph7-x527-w3h5","MGASA-2021-0485","OESA-2021-1413","RHBA-2022:8077","RHSA-2021:4861","UBUNTU-CVE-2021-42340"],"status":"published","title":"DoS via memory leak with WebSocket connections","description":"The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.11796,"percentile":0.96117,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-772"],"published":"2021-10-14T19:55:14Z","modified":"2026-11-02T19:46:30Z","fixes":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","fixed_in":["10.1.0-M6","10.0.12","9.0.54","8.5.72"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"tomcat","fixed_in":["8.5.72","9.0.54","10.0.12"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tomcat9","fixed_in":["9.0.54-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat9","fixed_in":["9.0.54-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat9","fixed_in":["9.0.54-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"tomcat9","fixed_in":["9.0.43-2~deb11u3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"tomcat","fixed_in":["9.0.10-22.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"tomcat","fixed_in":["9.0.10-22.oe1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pki-servlet-4.0-api","fixed_in":["1:9.0.50-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pki-servlet-engine","fixed_in":["1:9.0.50-1.el9"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"last_affected":"10.1.0-M5"},{"fixed":"10.1.0-M6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-M1"},{"fixed":"10.0.12"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.40"},{"fixed":"9.0.54"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.60"},{"fixed":"8.5.72"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"tomcat","ranges":[{"type":"SEMVER","events":[{"introduced":"8.5.60"},{"fixed":"8.5.72"},{"introduced":"9.0.40"},{"fixed":"9.0.54"},{"introduced":"10.0.1"},{"fixed":"10.0.12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-embed-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.2"}]}],"versions":["9.0.50","9.0.50-tuxcare.1"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.2"}]}],"versions":["9.0.50","9.0.50-tuxcare.1"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.2"}]}],"versions":["9.0.50","9.0.50-tuxcare.1"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.2"}]}],"versions":["9.0.50","9.0.50-tuxcare.1"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.2"}]}],"versions":["9.0.50","9.0.50-tuxcare.1"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.1"}]}],"versions":["9.0.46"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.1"}]}],"versions":["9.0.46"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.1"}]}],"versions":["9.0.46"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.1"}]}],"versions":["9.0.46"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.1"}]}],"versions":["9.0.46"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.109"},{"fixed":"7.0.109-tuxcare.5"}]}],"versions":["7.0.109","7.0.109-tuxcare.1","7.0.109-tuxcare.2","7.0.109-tuxcare.3","7.0.109-tuxcare.4"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.109"},{"fixed":"7.0.109-tuxcare.5"}]}],"versions":["7.0.109","7.0.109-tuxcare.1","7.0.109-tuxcare.2","7.0.109-tuxcare.3","7.0.109-tuxcare.4"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.109"},{"fixed":"7.0.109-tuxcare.5"}]}],"versions":["7.0.109","7.0.109-tuxcare.1","7.0.109-tuxcare.2","7.0.109-tuxcare.3","7.0.109-tuxcare.4"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.109"},{"fixed":"7.0.109-tuxcare.5"}]}],"versions":["7.0.109","7.0.109-tuxcare.1","7.0.109-tuxcare.2","7.0.109-tuxcare.3","7.0.109-tuxcare.4"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.109"},{"fixed":"7.0.109-tuxcare.5"}]}],"versions":["7.0.109","7.0.109-tuxcare.1","7.0.109-tuxcare.2","7.0.109-tuxcare.3","7.0.109-tuxcare.4"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.54-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.54-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.54-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-2~deb11u3"}]}],"versions":["9.0.43-1","9.0.43-2~deb11u1","9.0.43-2~deb11u2"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.0-M6"}]}],"versions":["10.1.0-M1","10.1.0-M2","10.1.0-M4","10.1.0-M5"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-M1"},{"fixed":"10.0.12"}]}],"versions":["10.0.0","10.0.0-M1","10.0.0-M10","10.0.0-M3","10.0.0-M4","10.0.0-M5","10.0.0-M6","10.0.0-M7","10.0.0-M8","10.0.0-M9","10.0.10","10.0.11","10.0.2","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.40"},{"fixed":"9.0.54"}]}],"versions":["9.0.40","9.0.41","9.0.43","9.0.44","9.0.45","9.0.46","9.0.48","9.0.50","9.0.52","9.0.53"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.60"},{"fixed":"8.5.72"}]}],"versions":["8.5.60","8.5.61","8.5.63","8.5.64","8.5.65","8.5.66","8.5.68","8.5.69","8.5.70","8.5.71"]},{"source":"osv","ecosystem":"Mageia:8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.54-1.mga8"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.10-22.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.10-22.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pki-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.50-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pki-servlet-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.50-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el7","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.50-3.redhat_00004.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el7","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.50-3.redhat_00004.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el7","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.50-3.redhat_00004.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el7","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.50-3.redhat_00004.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el7","package":"jws5-tomcat-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.50-3.redhat_00004.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el7","package":"jws5-tomcat-java-jdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.50-3.redhat_00004.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el7","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.50-3.redhat_00004.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el7","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.50-3.redhat_00004.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el7","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.50-3.redhat_00004.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el7","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.30-3.redhat_3.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el7","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.30-3.redhat_3.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el7","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.50-3.redhat_00004.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el7","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.50-3.redhat_00004.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el7","package":"jws5-tomcat-vault","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.8-4.Final_redhat_00004.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el7","package":"jws5-tomcat-vault-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.8-4.Final_redhat_00004.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el7","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.50-3.redhat_00004.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el8","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.50-3.redhat_00004.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el8","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.50-3.redhat_00004.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el8","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.50-3.redhat_00004.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el8","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.50-3.redhat_00004.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el8","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.50-3.redhat_00004.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el8","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.50-3.redhat_00004.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el8","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.50-3.redhat_00004.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el8","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.30-3.redhat_3.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el8","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.30-3.redhat_3.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el8","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.50-3.redhat_00004.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el8","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.50-3.redhat_00004.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el8","package":"jws5-tomcat-vault","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.8-4.Final_redhat_00004.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el8","package":"jws5-tomcat-vault-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.8-4.Final_redhat_00004.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.6::el8","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.50-3.redhat_00004.1.el8jws"}]}],"bundled":6}],"products":[{"vendor":"apache","product":"tomcat"},{"vendor":"apache software foundation","product":"apache tomcat"},{"vendor":"debian","product":"debian_linux"},{"vendor":"netapp","product":"hci"},{"vendor":"netapp","product":"management_services_for_element_software"},{"vendor":"oracle","product":"agile_engineering_data_management"},{"vendor":"oracle","product":"big_data_spatial_and_graph"},{"vendor":"oracle","product":"communications_diameter_signaling_router"},{"vendor":"oracle","product":"hospitality_cruise_shipboard_property_management_system"},{"vendor":"oracle","product":"managed_file_transfer"},{"vendor":"oracle","product":"middleware_common_libraries_and_tools"},{"vendor":"oracle","product":"payment_interface"},{"vendor":"oracle","product":"retail_customer_insights"},{"vendor":"oracle","product":"retail_data_extractor_for_merchandising"},{"vendor":"oracle","product":"retail_eftlink"},{"vendor":"oracle","product":"retail_financial_integration"},{"vendor":"oracle","product":"retail_store_inventory_management"},{"vendor":"oracle","product":"sd-wan_edge"},{"vendor":"oracle","product":"taleo_platform"}],"references":[{"url":"https://lists.apache.org/thread.html/r83a35be60f06aca2065f188ee542b9099695d57ced2e70e0885f905c%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC","x_transferred","Mailing List","Vendor Advisory","advisory","web","article","report"]},{"url":"https://lists.apache.org/thread.html/r8097a2d1550aa78e585fc77e602b9046e6d4099d8d132497c5387784%40%3Ccommits.myfaces.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.debian.org/security/2021/dsa-5009","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://security.netapp.com/advisory/ntap-20211104-0001/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10379","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://security.gentoo.org/glsa/202208-34","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42340","tags":["web","advisory"]},{"url":"https://lists.apache.org/thread.html/r8097a2d1550aa78e585fc77e602b9046e6d4099d8d132497c5387784@%3Ccommits.myfaces.apache.org%3E","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/31d62426645824bdfe076a0c0eafa904d90b4fb9","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/80f1438ec45e77a07b96419808971838d259eb47","tags":["web","report"]},{"url":"https://github.com/apache/tomcat/commit/d27535bdee95d252418201eb21e9d29476aa6b6a","tags":["web","report"]},{"url":"https://github.com/apache/tomcat/commit/d5a6660cba7f51589468937bf3bbad4db7810371","tags":["web"]},{"url":"https://tomcat.apache.org/security-9.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-8.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-10.html","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20211104-0001","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wph7-x527-w3h5"},{"url":"https://errata.cloudlinux.com/ubuntu18-els/CLSA-2025-1748282295.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-42340","tags":["advisory"]},{"url":"https://github.com/apache/tomcat","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2021-0485.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29351","tags":["report"]},{"url":"https://www.debian.org/security/2021/dsa-4952","tags":["web"]},{"url":"http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.48","tags":["web"]},{"url":"http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.44","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2021/09/15/6","tags":["web"]},{"url":"http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.54","tags":["web","article"]},{"url":"https://www.openwall.com/lists/oss-security/2021/10/14/1","tags":["web","report"]},{"url":"https://www.debian.org/security/2021/dsa-4986","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1413","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHBA-2022:8077","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2060910","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhba-2022_8077.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-42340","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2014356","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-42340","tags":["advisory","report"]},{"url":"http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.12","tags":["article"]},{"url":"http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.0-M6","tags":["article"]},{"url":"http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.72","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4861","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1981533","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1981544","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4861.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3712","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1995634","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3712","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3712","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20210824.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23840","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1930324","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23840","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23840","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20210216.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23841","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1930310","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23841","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23841","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-30640","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-30640","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-30640","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33037","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33037","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33037","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-42340","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-42340","title":"DoS via memory leak with WebSocket connections","description":"The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.","status":"published","published":"2021-10-14T19:55:14Z","modified":"2024-08-04T03:30:38.354Z","cwes":["CWE-772"],"updated_at":"2026-11-02T14:32:58.359368Z"}],"euvd":[{"id":"EUVD-2021-2266","description":"The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.","status":"published","published":"2021-10-14T19:55:14Z","modified":"2024-08-04T03:30:38Z","updated_at":"2026-11-03T03:24:16.217613Z"}],"ghsa":[{"id":"GHSA-wph7-x527-w3h5","title":"Missing Release of Resource after Effective Lifetime in Apache Tomcat","description":"The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.","status":"published","published":"2021-10-15T18:51:34Z","modified":"2024-03-11T16:36:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T14:37:40.81935Z"}],"nvd":[{"id":"CVE-2021-42340","description":"The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.","status":"published","published":"2021-10-14T20:15:09.06Z","modified":"2026-06-17T04:09:40.45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T14:06:59.689345Z"}],"osv":[{"id":"CVE-2021-42340","description":"The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.","status":"published","published":"2021-10-14T20:15:09.06Z","modified":"2026-10-24T10:30:51.113869279Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:21.557945Z"},{"id":"DEBIAN-CVE-2021-42340","description":"The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.","status":"published","published":"2021-10-14T20:15:09.06Z","modified":"2026-10-23T18:00:20.567447697Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.799676Z"},{"id":"GHSA-wph7-x527-w3h5","title":"Missing Release of Resource after Effective Lifetime in Apache Tomcat","description":"The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.","status":"published","published":"2021-10-15T18:51:34Z","modified":"2024-03-11T16:46:20.172045Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T15:46:58.767335Z"},{"id":"OESA-2021-1413","title":"tomcat security update","description":"The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open development project\r\n\r\nSecurity Fix(es):\r\n\r\nThe fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.(CVE-2021-42340)","status":"published","published":"2021-11-04T11:04:41Z","modified":"2026-08-18T01:16:08.152390467Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHBA-2022:8077","title":"Red Hat Bug Fix Advisory: pki-servlet-engine bug fix and enhancement update","status":"published","published":"2024-09-13T17:27:06Z","modified":"2026-10-02T10:01:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2021:4861","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 5.6.0 Security release","status":"published","published":"2024-09-29T18:14:16Z","modified":"2026-10-02T10:01:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"UBUNTU-CVE-2021-42340","description":"The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.","status":"withdrawn","published":"2021-10-14T20:15:00Z","modified":"2025-07-14T06:45:44.951772Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"BIT-tomcat-2021-42340","title":"DoS via memory leak with WebSocket connections","description":"The fix for bug 63362 present in Apache Tomcat 10.1.0 to 10.1.0, 10.0.0 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.","status":"published","published":"2024-03-06T11:09:50.28Z","modified":"2026-09-08T08:48:20.829236787Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"CLSA-2025-1748282295","title":"Fix of 34 CVEs","description":"   * SECURITY UPDATE: Misc vulnerability fixes\n     - CVE-2019-12418, CVE-2019-17563, CVE-2020-1935,\n       CVE-2020-11996, CVE-2020-13934, CVE-2020-13935,\n       CVE-2020-13943, CVE-2020-17527, CVE-2021-24122,\n       CVE-2021-30639, CVE-2021-30640, CVE-2021-33037,\n       CVE-2021-42340, CVE-2021-43980, CVE-2022-25762,\n       CVE-2022-34305, CVE-2022-45143, CVE-2023-24998,\n       CVE-2023-28709, CVE-2023-34981, CVE-2023-42794,\n       CVE-2024-21733\n   * Update to 8.5.100\n     - debian/rules,\n       debian/libtomcat8-java.poms,\n       debian/maven.rules,\n       debian/tomcat8-common.links,\n       debian/patches/0018-fix-manager-webapp.patch,\n       debian/patches/0019-add-distribution-to-error-page.patch,\n       debian/patches/0021-dont-test-unsupported-ciphers.patch,\n       debian/patches/0101-skipping-tests-incompatible-with-firewall.patch:\n       updated\n     - debian/patches/0002-do-not-load-AJP13-connector-by-default.patch,\n       debian/patches/0026-easymock4-compatibility.patch:\n       removed as they were applied in upstream\n     - CVE-2019-0221.patch, CVE-2019-10072-1.patch,\n       CVE-2019-10072-2.patch, CVE-2022-42252.patch,\n       CVE-2020-1938.patch, CVE-2021-25122.patch,\n       CVE-2021-41079.patch, CVE-2022-29885.patch,\n       CVE-2020-9484.patch, CVE-2021-25329-pre1.patch,\n       CVE-2021-25329.patch, CVE-2022-23181.patch,\n       CVE-2023-44487.patch, CVE-2023-46589-pre1.patch,\n       CVE-2023-46589-pre2.patch, CVE-2023-46589-pre3.patch,\n       CVE-2023-46589-pre4.patch, CVE-2023-46589.patch:\n       removed because these CVEs were fixed in upstream\n   * Internal tests\n     - debian/test_certs/*: updated from upstream branch 9.0.x, as the\n       8.0.x certs were expired","status":"published","published":"2025-05-27T13:45:18Z","modified":"2026-06-04T10:03:30.412984079Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CLSA-2025-1764720465","title":"TuxCare security update for 5 packages (18 CVEs)","description":"TuxCare rebuilt 5 packages to address 18 CVEs. Fixed in 9.0.50-tuxcare.2.","status":"published","published":"2026-08-04T14:52:06Z","modified":"2026-11-02T19:45:14.144527872Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1773188120","title":"TuxCare security update for 5 packages (23 CVEs)","description":"TuxCare rebuilt 5 packages to address 23 CVEs. Fixed in 9.0.46-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-11-02T19:45:15.814263441Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1792667085","title":"TuxCare security update for 7 packages (24 CVEs)","description":"TuxCare rebuilt 7 packages to address 24 CVEs. Fixed in 8.5.46-tuxcare.1.","status":"published","published":"2026-10-22T11:04:45Z","modified":"2026-11-02T19:46:30.557831164Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792687381","title":"TuxCare security update for 5 packages (4 CVEs)","description":"TuxCare rebuilt 5 packages to address 4 CVEs. Fixed in 7.0.109-tuxcare.5.","status":"published","published":"2026-10-22T16:43:01Z","modified":"2026-11-02T19:46:30.557121765Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"DSA-5009-1","title":"tomcat9 - security update","status":"published","published":"2021-11-12T00:00:00Z","modified":"2026-03-09T02:09:30.752669Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2021-0485","title":"Updated tomcat packages fix security vulnerability","description":"A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to\nauthenticate using variations of a valid user name and/or to bypass some\nof the protection provided by the LockOut Realm. (CVE-2021-30640)\n\nApache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66\ndid not correctly parse the HTTP transfer-encoding request header in some\ncircumstances leading to the possibility to request smuggling when used\nwith a reverse proxy. Specifically: - Tomcat incorrectly ignored the\ntransfer encoding header if the client declared it would only accept an\nHTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat\ndid not ensure that, if present, the chunked encoding was the final\nencoding. (CVE-2021-33037)\n\nApache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2\ndid not properly validate incoming TLS packets. When Tomcat was configured\nto use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet\ncould be used to trigger an infinite loop resulting in a denial of service.\n(CVE-2021-41079)\n\nThe fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5,\n10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a\nmemory leak. The object introduced to collect metrics for HTTP upgrade\nconnections was not released for WebSocket connections once the\nconnection was closed. This created a memory leak that, over time, could\nlead to a denial of service via an OutOfMemoryError. (CVE-2021-42340)\n","status":"published","published":"2021-10-23T10:05:28Z","modified":"2026-04-16T04:40:35.201159912Z","updated_at":"2026-11-02T15:49:41.849028Z"}]}}