Read the docs
TI-2021-18769 Aliases CVE-2021-42340GHSA-wph7-x527-w3h5

DoS via memory leak with WebSocket connections

Priority MEDIUM 46CWE-772Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 6 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-772.

Summary

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.

Why it matters now

EPSS 0.11796 96th percentileScored 2026-11-07
Fix Partial org.apache.tomcat:tomcat (Maven): 10.1.0-M6, 10.0.12, 9.0.54 +1Red Hat: 4 advisoriesRed Hat: 6 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache TomcatApache Tomcat 10 10.0.0-M10 to 10.0.11; Apache Tomcat 10 10.1.0-M1 to 10.1.0-M5; Apache Tomcat 9 9.0.40 to 9.0.53; Apache Tomcat 8 8.5.60 to 8.5.71—No fix listedCNA
—org.apache.tomcat:tomcat (Maven)10.1.0-M1 to before 10.1.0-M610.1.0-M6Patch availableGHSA-wph7-x527-w3h5
—org.apache.tomcat:tomcat (Maven)10.0.0-M1 to before 10.0.1210.0.12Patch availableGHSA-wph7-x527-w3h5
—org.apache.tomcat:tomcat (Maven)9.0.40 to before 9.0.549.0.54Patch availableGHSA-wph7-x527-w3h5
—org.apache.tomcat:tomcat (Maven)8.5.60 to before 8.5.728.5.72Patch availableGHSA-wph7-x527-w3h5
  • Apache Tomcat VendorApache Affected Apache Tomcat 10 10.0.0-M10 to 10.0.11; Apache Tomcat 10 10.1.0-M1 to 10.1.0-M5; Apache Tomcat 9 9.0.40 to 9.0.53; Apache Tomcat 8 8.5.60 to 8.5.71 Fixed in — No fix listed CNA
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 10.1.0-M1 to before 10.1.0-M6 Fixed in 10.1.0-M6 Patch available GHSA-wph7-x527-w3h5
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 10.0.0-M1 to before 10.0.12 Fixed in 10.0.12 Patch available GHSA-wph7-x527-w3h5
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 9.0.40 to before 9.0.54 Fixed in 9.0.54 Patch available GHSA-wph7-x527-w3h5
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 8.5.60 to before 8.5.72 Fixed in 8.5.72 Patch available GHSA-wph7-x527-w3h5

CPE configurations NVD · 35

CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*8.5.60 to before 8.5.72; 9.0.40 to before 9.0.54; 10.0.1 to before 10.0.12VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone10:*:*:*:*:*:*10.0.0 milestone10VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:*10.1.0 milestone1VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:*10.1.0 milestone2VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:*10.1.0 milestone3VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*10.1.0 milestone4VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:*10.1.0 milestone5VulnerableApache
cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 8.5.60 to before 8.5.72; 9.0.40 to before 9.0.54; 10.0.1 to before 10.0.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone10:*:*:*:*:*:* Versions 10.0.0 milestone10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:* Versions 10.1.0 milestone1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:* Versions 10.1.0 milestone2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:* Versions 10.1.0 milestone3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:* Versions 10.1.0 milestone4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:* Versions 10.1.0 milestone5 Vulnerable ·Apache
  • cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
Show 25 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*6.2.1.0VulnerableOracle
cpe:2.3:a:oracle:big_data_spatial_and_graph:*:*:*:*:*:*:*:*before 23.1VulnerableOracle
cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*8.0.0.0 – 8.5.0.2VulnerableOracle
cpe:2.3:a:oracle:hospitality_cruise_shipboard_property_management_system:20.1.0:*:*:*:*:*:*:*20.1.0VulnerableOracle
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:payment_interface:19.1:*:*:*:*:*:*:*19.1VulnerableOracle
cpe:2.3:a:oracle:payment_interface:20.3:*:*:*:*:*:*:*20.3VulnerableOracle
cpe:2.3:a:oracle:retail_customer_insights:15.0.2:*:*:*:*:*:*:*15.0.2VulnerableOracle
cpe:2.3:a:oracle:retail_customer_insights:16.0.2:*:*:*:*:*:*:*16.0.2VulnerableOracle
cpe:2.3:a:oracle:retail_data_extractor_for_merchandising:15.0.2:*:*:*:*:*:*:*15.0.2VulnerableOracle
cpe:2.3:a:oracle:retail_data_extractor_for_merchandising:16.0.2:*:*:*:*:*:*:*16.0.2VulnerableOracle
cpe:2.3:a:oracle:retail_eftlink:21.0.0:*:*:*:*:*:*:*21.0.0VulnerableOracle
cpe:2.3:a:oracle:retail_financial_integration:16.0.1:*:*:*:*:*:*:*16.0.1VulnerableOracle
cpe:2.3:a:oracle:retail_financial_integration:19.0.0:*:*:*:*:*:*:*19.0.0VulnerableOracle
cpe:2.3:a:oracle:retail_store_inventory_management:14.0.4.13:*:*:*:*:*:*:*14.0.4.13VulnerableOracle
cpe:2.3:a:oracle:retail_store_inventory_management:14.1.3.5:*:*:*:*:*:*:*14.1.3.5VulnerableOracle
cpe:2.3:a:oracle:retail_store_inventory_management:14.1.3.14:*:*:*:*:*:*:*14.1.3.14VulnerableOracle
cpe:2.3:a:oracle:retail_store_inventory_management:15.0.3.3:*:*:*:*:*:*:*15.0.3.3VulnerableOracle
cpe:2.3:a:oracle:retail_store_inventory_management:15.0.3.8:*:*:*:*:*:*:*15.0.3.8VulnerableOracle
cpe:2.3:a:oracle:retail_store_inventory_management:16.0.3.7:*:*:*:*:*:*:*16.0.3.7VulnerableOracle
cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*9.0VulnerableOracle
cpe:2.3:a:oracle:sd-wan_edge:9.1:*:*:*:*:*:*:*9.1VulnerableOracle
cpe:2.3:a:oracle:taleo_platform:*:*:*:*:*:*:*:*all versionsVulnerableOracle
  • cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:* Versions 6.2.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:big_data_spatial_and_graph:*:*:*:*:*:*:*:* Versions before 23.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* Versions 8.0.0.0 – 8.5.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hospitality_cruise_shipboard_property_management_system:20.1.0:*:*:*:*:*:*:* Versions 20.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:payment_interface:19.1:*:*:*:*:*:*:* Versions 19.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:payment_interface:20.3:*:*:*:*:*:*:* Versions 20.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_customer_insights:15.0.2:*:*:*:*:*:*:* Versions 15.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_customer_insights:16.0.2:*:*:*:*:*:*:* Versions 16.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_data_extractor_for_merchandising:15.0.2:*:*:*:*:*:*:* Versions 15.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_data_extractor_for_merchandising:16.0.2:*:*:*:*:*:*:* Versions 16.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_eftlink:21.0.0:*:*:*:*:*:*:* Versions 21.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_financial_integration:16.0.1:*:*:*:*:*:*:* Versions 16.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_financial_integration:19.0.0:*:*:*:*:*:*:* Versions 19.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_store_inventory_management:14.0.4.13:*:*:*:*:*:*:* Versions 14.0.4.13 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_store_inventory_management:14.1.3.5:*:*:*:*:*:*:* Versions 14.1.3.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_store_inventory_management:14.1.3.14:*:*:*:*:*:*:* Versions 14.1.3.14 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_store_inventory_management:15.0.3.3:*:*:*:*:*:*:* Versions 15.0.3.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_store_inventory_management:15.0.3.8:*:*:*:*:*:*:* Versions 15.0.3.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_store_inventory_management:16.0.3.7:*:*:*:*:*:*:* Versions 16.0.3.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:sd-wan_edge:9.1:*:*:*:*:*:*:* Versions 9.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:taleo_platform:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Oracle

Remediation

  • Fix · GHSA-wph7-x527-w3h5 org.apache.tomcat:tomcat (Maven) Fixed in 10.1.0-M6 Advisory →
  • Fix · GHSA-wph7-x527-w3h5 org.apache.tomcat:tomcat (Maven) Fixed in 10.0.12 Advisory →
  • Fix · GHSA-wph7-x527-w3h5 org.apache.tomcat:tomcat (Maven) Fixed in 9.0.54 Advisory →
  • Fix · GHSA-wph7-x527-w3h5 org.apache.tomcat:tomcat (Maven) Fixed in 8.5.72 Advisory →

Red Hat 4 advisories

  • RHSA-2022:5532 Released 2022-07-07 · Red Hat rating Important
    Red Hat Fuse 7.11.0 release and security update
    • Red Hat Fuse 7.11
  • RHSA-2022:1179 Released 2022-04-12 · Red Hat rating Important
    Red Hat support for Spring Boot 2.5.10 update
    • Red Hat Support for Spring Boot 2.5.10
  • RHSA-2021:4861 Released 2021-11-30 · Red Hat rating Important
    Red Hat JBoss Web Server 5.6.0 Security release
    • Red Hat JBoss Web Server 5.6 for RHEL 7 Server jws5-tomcat-9.0.50-3.redhat_00004.1.el7jws, jws5-tomcat-admin-webapps-9.0.50-3.redhat_00004.1.el7jws, jws5-tomcat-docs-webapp-9.0.50-3.redhat_00004.1.el7jws +12
    • Red Hat JBoss Web Server 5.6 for RHEL 8 jws5-tomcat-9.0.50-3.redhat_00004.1.el8jws, jws5-tomcat-admin-webapps-9.0.50-3.redhat_00004.1.el8jws, jws5-tomcat-docs-webapp-9.0.50-3.redhat_00004.1.el8jws +10
Show 1 more Red Hat advisories
  • RHSA-2021:4863 Released 2021-11-30 · Red Hat rating Important
    Red Hat JBoss Web Server 5.6.0 Security release
    • Red Hat JBoss Web Server 5

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 9)Fixed—
Red Hat Fuse 7.11Fixed RHSA-2022:5532
Red Hat JBoss Web Server 5Fixed RHSA-2021:4863
Red Hat JBoss Web Server 5.6 for RHEL 7 ServerFixed RHSA-2021:4861
Red Hat JBoss Web Server 5.6 for RHEL 8Fixed RHSA-2021:4861
Red Hat Support for Spring Boot 2.5.10Fixed RHSA-2022:1179
Not affected: 9 products
  • Red Hat Decision Manager 7
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat JBoss Data Grid 6
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Web Server 3
  • Red Hat Process Automation 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-42340
  2. 2026-10-03 Alias added: GHSA-wph7-x527-w3h5

References

Patch 3

Advisory 6

Other 11

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
See all 273 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences