Read the docs
TI-2021-11030 Aliases CVE-2021-30639GHSA-44qp-qhfv-c7f6

DoS after non-blocking IO error

Priority MEDIUM 43CWE-755Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS. Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.

Why it matters now

EPSS 0.06889 94th percentileScored 2026-11-07
Fix Partial org.apache.tomcat:tomcat (Maven): 10.0.5, 9.0.45, 8.5.65Red Hat: 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache TomcatApache Tomcat 10 10.0.3 to 10.0.4; Apache Tomcat 9 9.0.44; Apache Tomcat 8.5 8.5.64—No fix listedCNA
—org.apache.tomcat:tomcat (Maven)10.0.3 to before 10.0.510.0.5Patch availableGHSA-44qp-qhfv-c7f6
—org.apache.tomcat:tomcat (Maven)9.0.0 to before 9.0.459.0.45Patch availableGHSA-44qp-qhfv-c7f6
—org.apache.tomcat:tomcat (Maven)before 8.5.658.5.65Patch availableGHSA-44qp-qhfv-c7f6
  • Apache Tomcat VendorApache Affected Apache Tomcat 10 10.0.3 to 10.0.4; Apache Tomcat 9 9.0.44; Apache Tomcat 8.5 8.5.64 Fixed in — No fix listed CNA
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 10.0.3 to before 10.0.5 Fixed in 10.0.5 Patch available GHSA-44qp-qhfv-c7f6
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 9.0.0 to before 9.0.45 Fixed in 9.0.45 Patch available GHSA-44qp-qhfv-c7f6
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected before 8.5.65 Fixed in 8.5.65 Patch available GHSA-44qp-qhfv-c7f6

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:8.5.64:*:*:*:*:*:*:*8.5.64VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.44:*:*:*:*:*:*:*9.0.44VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.3:*:*:*:*:*:*:*10.0.3VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.4:*:*:*:*:*:*:*10.0.4VulnerableApache
cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:*before 5.10.0VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:*5.10.0VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:*5.10.0 update_1VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_10:*:*:*:*:*:*5.10.0 update_10VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:*5.10.0 update_2VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:*5.10.0 update_3VulnerableMcAfee
  • cpe:2.3:a:apache:tomcat:8.5.64:*:*:*:*:*:*:* Versions 8.5.64 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.44:*:*:*:*:*:*:* Versions 9.0.44 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.3:*:*:*:*:*:*:* Versions 10.0.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.4:*:*:*:*:*:*:* Versions 10.0.4 Vulnerable ·Apache
  • cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:* Versions before 5.10.0 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:* Versions 5.10.0 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:* Versions 5.10.0 update_1 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_10:*:*:*:*:*:* Versions 5.10.0 update_10 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:* Versions 5.10.0 update_2 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:* Versions 5.10.0 update_3 Vulnerable ·McAfee
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:*5.10.0 update_4VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:*5.10.0 update_5VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:*5.10.0 update_6VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:*5.10.0 update_7VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:*5.10.0 update_8VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_9:*:*:*:*:*:*5.10.0 update_9VulnerableMcAfee
cpe:2.3:a:oracle:big_data_spatial_and_graph:*:*:*:*:*:*:*:*before 23.1VulnerableOracle
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:* Versions 5.10.0 update_4 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:* Versions 5.10.0 update_5 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:* Versions 5.10.0 update_6 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:* Versions 5.10.0 update_7 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:* Versions 5.10.0 update_8 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_9:*:*:*:*:*:* Versions 5.10.0 update_9 Vulnerable ·McAfee
  • cpe:2.3:a:oracle:big_data_spatial_and_graph:*:*:*:*:*:*:*:* Versions before 23.1 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-44qp-qhfv-c7f6 org.apache.tomcat:tomcat (Maven) Fixed in 10.0.5 Advisory →
  • Fix · GHSA-44qp-qhfv-c7f6 org.apache.tomcat:tomcat (Maven) Fixed in 9.0.45 Advisory →
  • Fix · GHSA-44qp-qhfv-c7f6 org.apache.tomcat:tomcat (Maven) Fixed in 8.5.65 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
Not affected: 14 products
  • Red Hat Decision Manager 7
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Fuse 7
  • Red Hat JBoss Data Grid 6
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Fuse 6
  • Red Hat JBoss Web Server 3
  • Red Hat JBoss Web Server 5
  • Red Hat Process Automation 7
  • Red Hat support for Spring Boot

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-30639
  2. 2026-10-03 Alias added: GHSA-44qp-qhfv-c7f6

References

Patch 1

Advisory 5

Other 5

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
See all 273 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences