Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-42340

DoS via memory leak with WebSocket connections

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Tomcat

  • Apache Tomcat 10 10.0.0-M10 to 10.0.11affected
  • Apache Tomcat 10 10.1.0-M1 to 10.1.0-M5affected
  • Apache Tomcat 9 9.0.40 to 9.0.53affected
  • Apache Tomcat 8 8.5.60 to 8.5.71affected

References