CVE-2021-30639

A flaw was found in Apache Tomcat. This flaw allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This means that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users can trigger non-blocking I/O errors (ex. by dropping a connection), creating the possibility of triggering a denial of service. Applications that do not use non-blocking I/O are not exposed to this vulnerability. The highest threat from this vulnerability is to system availability.