Fixed in Apache Tomcat 10.1.0-M6

Important: Denial of Service CVE-2021-42340

The fix for bug 63362 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the WebSocket connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.

This was fixed with commit d5a6660c.

The memory leak was reported publicly via the users mailing list on 23 September 2021. The security implications were identified by the Tomcat Security team the same day. The issue was made public on 14 October 2021.

Affects: 10.1.0-M1 to 10.1.0-M5