{"id":"CVE-2021-42340","published":"2021-10-14T19:55:14Z","modified":"2024-08-04T03:30:38Z","title":"DoS via memory leak with WebSocket connections","vendor":"Apache","product":"Apache Tomcat","tier":"tail","description":{"text":"The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.11796,"percentile":0.96067,"provenance":"source"},"cwes":[{"id":"CWE-772","name":"Missing Release of Resource after Effective Lifetime"}],"references":[{"url":"https://lists.apache.org/thread.html/r83a35be60f06aca2065f188ee542b9099695d57ced2e70e0885f905c%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC"]},{"url":"https://lists.apache.org/thread.html/r8097a2d1550aa78e585fc77e602b9046e6d4099d8d132497c5387784%40%3Ccommits.myfaces.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.debian.org/security/2021/dsa-5009","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20211104-0001/","tags":["x_refsource_CONFIRM"]},{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10379","tags":["x_refsource_CONFIRM"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_refsource_MISC"]},{"url":"https://security.gentoo.org/glsa/202208-34","tags":["vendor-advisory","x_refsource_GENTOO"]}],"priority":{"score":19.2,"factors":[{"name":"EPSS percentile","points":19.21}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":["Apache Tomcat 10 10.0.0-M10 to 10.0.11","Apache Tomcat 10 10.1.0-M1 to 10.1.0-M5","Apache Tomcat 9 9.0.40 to 9.0.53","Apache Tomcat 8 8.5.60 to 8.5.71"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=10.1.0-M1, <10.1.0-M6",">=10.0.0-M1, <10.0.12",">=9.0.40, <9.0.54",">=8.5.60, <8.5.72"],"patched":["10.1.0-M6","10.0.12","9.0.54","8.5.72"],"from":["GHSA-wph7-x527-w3h5"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-2266","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2022-25762","published":"2022-05-13","fixed":"9.0.20","kev":false,"link":{"from":"CVE-2021-42340","to":"CVE-2022-25762","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"8.5.72","toFixed":"8.5.75","daysApart":211}]}},{"cve":"CVE-2021-33037","published":"2021-07-12","fixed":"10.0.7","kev":false,"link":{"from":"CVE-2021-33037","to":"CVE-2021-42340","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"9.0.48","toFixed":"9.0.54","daysApart":94},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"8.5.68","toFixed":"8.5.72","daysApart":94}]}},{"cve":"CVE-2022-23181","published":"2022-01-27","fixed":"10.0.16","kev":false,"link":{"from":"CVE-2021-42340","to":"CVE-2022-23181","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"9.0.54","toFixed":"9.0.58","daysApart":105},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"8.5.72","toFixed":"8.5.75","daysApart":105}]}},{"cve":"CVE-2021-43980","published":"2022-09-28","fixed":"10.1.0-M14","kev":false},{"cve":"CVE-2022-29885","published":"2022-05-12","fixed":"10.1.0-M15","kev":false},{"cve":"CVE-2022-34305","published":"2022-06-23","fixed":"10.1.0-M17","kev":false},{"cve":"CVE-2021-42340","published":"2021-10-14","fixed":"10.1.0-M6","kev":false},{"cve":"CVE-2023-41080","published":"2023-08-25","fixed":"11.0.0-M11","kev":false,"link":{"from":"CVE-2021-42340","to":"CVE-2023-41080","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"10.1.0-M6","toFixed":"10.1.13","daysApart":680}]}},{"cve":"CVE-2023-42795","published":"2023-10-10","fixed":"11.0.0-M12","kev":false},{"cve":"CVE-2023-45648","published":"2023-10-10","fixed":"11.0.0-M12","kev":false}],"package":"Maven:org.apache.tomcat:tomcat"}}