CVE-2021-42340 DoS via memory leak with WebSocket connections

2021-10-1419:55:14

CWE-772

apache

www.cve.org

7.6 High

AI Score

Confidence

High

0.019 Low

EPSS

Percentile

88.7%

JSON

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.

CNA Affected

[
  {
    "product": "Apache Tomcat",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "Apache Tomcat 10 10.0.0-M10 to 10.0.11"
      },
      {
        "status": "affected",
        "version": "Apache Tomcat 10 10.1.0-M1 to 10.1.0-M5"
      },
      {
        "status": "affected",
        "version": "Apache Tomcat 9 9.0.40 to 9.0.53"
      },
      {
        "status": "affected",
        "version": "Apache Tomcat 8 8.5.60 to 8.5.71"
      }
    ]
  }
]