CVE-2021-42340 DoS via memory leak with WebSocket connections
A memory leak in Apache Tomcat's WebSocket handling can cause an OutOfMemoryError, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-42340?
CVE-2021-42340 is a high-severity denial of service vulnerability in Apache Tomcat, published on 14 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.
Weakness: CWE-772
Which versions are affected by CVE-2021-42340?
9 open source packages ship an affected version, including org.apache.tomcat:tomcat and tomcat. It affects 18 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.tomcat:tomcat Maven | From 10.0.0-M1 | 10.0.12 |
org.apache.tomcat:tomcat Maven | From 10.0.0-M1 | 10.0.12 |
org.apache.tomcat:tomcat Maven | From 10.1.0-M1 | 10.1.0-M6 |
org.apache.tomcat:tomcat Maven | From 10.1.0-M1 | 10.1.0-M6 |
org.apache.tomcat:tomcat Maven | From 8.5.60 | 8.5.72 |
org.apache.tomcat:tomcat Maven | From 8.5.60 | 8.5.72 |
3 more packages
org.apache.tomcat:tomcat Maven | From 9.0.40 | 9.0.54 |
org.apache.tomcat:tomcat Maven | From 9.0.40 | 9.0.54 |
tomcat Bitnami | From 8.5.60 | 8.5.72, 9.0.54, 10.0.12 |
Linux distribution packages (2)
pki-servlet-4.0-api Red Hat:enterprise_linux:9::appstream | All versions | 1:9.0.50-1.el9 |
pki-servlet-engine Red Hat:enterprise_linux:9::appstream | All versions | 1:9.0.50-1.el9 |
Products include Apache Tomcat, Debian Debian Linux, Netapp Hci, Netapp Management Services for Element Software, Oracle Agile Engineering Data Management, Oracle Big Data Spatial and Graph and 12 more.
How do I fix CVE-2021-42340?
Upgrade org.apache.tomcat:tomcat to a fixed version for your release line: 10.0.12, 10.1.0-M6, 8.5.72 or 9.0.54.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-42340 being exploited?
There is no known exploitation of CVE-2021-42340 in the wild and no public exploit code.
Other vulnerabilities in Apache Tomcat
Sources
Also known as BIT-tomcat-2021-42340, DEBIAN-CVE-2021-42340, DSA-5009-1, GHSA-wph7-x527-w3h5, OESA-2021-1413, RHBA-2022:8077.