CVE-2024-1635 Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol

A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the server will end with both memory and...

tomcat: OutOfMemoryError caused by HTTP upgrade connection leak could lead to DoS

A memory leak flaw was found in Apache Tomcat, where an HTTP upgrade connection does not release for WebSocket connections once the WebSocket connection is closed. If a sufficient number of such requests are made, an OutOfMemoryError occurs, leading to a denial of service. The highest threat from...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 5.6.0 Security release

Red Hat JBoss Web Server 5.6.0 zip release is now available for Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, and Microsoft Windows. Red Hat Product Security has rated this release as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which giv...

[SECURITY] [DSA 5009-1] tomcat9 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5009-1 [email protected] https://www.debian.org/security/ Markus Koschany November 12, 2021 https://www.debian.org/security/faq -...

OESA-2021-1413 tomcat security update

The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open developmen...

Apache Tomcat 10.0.0-M10 < 10.0.12 Denial of Service

The version of Apache Tomcat installed on the remote host is 10.1.0-M1 to 10.1.0-M5, 10.0.0-M10 to 10.0.11, 9.0.40 to 9.0.53 or 8.5.60 to 8.5.71. It is, therefore, affected by a denial of service. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket...

Apache Tomcat 8.5.60 < 8.5.72 Denial of Service

The version of Apache Tomcat installed on the remote host is 10.1.0-M1 to 10.1.0-M5, 10.0.0-M10 to 10.0.11, 9.0.40 to 9.0.53 or 8.5.60 to 8.5.71. It is, therefore, affected by a denial of service. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket...

CVE-2021-42340

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was...

CVE-2021-42340

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was...

Memory corruption

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was...

CVE-2021-42340

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was...

Apache Tomcat 10.0.0.M10 < 10.0.12

The version of Tomcat installed on the remote host is prior to 10.0.12. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat10.0.12security-10 advisory. - The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.5...

CVE-2021-42340: Missing Release of Resource after Effective Lifetime

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was...

Fixed in Apache Tomcat 8.5.72

Important: Denial of Service CVE-2021-42340 The fix for bug 63362 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the WebSocket connection was closed. This created a memory leak that, over time, could...

Fixed in Apache Tomcat 10.1.0-M6

Important: Denial of Service CVE-2021-42340 The fix for bug 63362 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the WebSocket connection was closed. This created a memory leak that, over time, could...

PT-2020-5486

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 8.5.1 through 8.5.56 Apache Tomcat versions 9.0.0.M5 through 9.0.36 Apache Tomcat versions 10.0.0-M1 through 10.0.0-M6 Description The issue is related to an h2c direct connection to Apache Tomcat, where the HTTP/1.1...

Digium Asterisk res_http_websocket Denial of Service (CVE-2018-17281)

A denial of service vulnerability exists in Digium Asterisk reshttpwebsocket. The vulnerability may occur when sending an HTTP Upgrade Request. Successful exploitation of this vulnerability could allow a remote attacker to cause denial of service conditions on the target system...

Excessive memory allocation

In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the handshake, holding the entire request body in memory. There should be a reasonnable limit 8192 bytes above which the WebSocket gets an HTTP response with the...

CVE-2018-12541

In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the handshake, holding the entire request body in memory. There should be a reasonnable limit 8192 bytes above which the WebSocket gets an HTTP response with the...

CVE-2018-12541

In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the handshake, holding the entire request body in memory. There should be a reasonnable limit 8192 bytes above which the WebSocket gets an HTTP response with the...