CVE-2021-30640: Auth weakness in JNDIRealm

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 9.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-07-12 · updated 2026-10-08
Weakness: CWE-116

Description

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65.

Affected products

Apache Tomcat: from 7.0.0 before 7.0.109; from 8.5.0 before 8.5.66; from 9.0.0 before 9.0.46; from 10.0.0 before 10.0.6 — fixed in 10.0.6, 7.0.109, 8.5.66, 9.0.46
Debian Linux: 9.0, 10.0, 11.0
Oracle Communications Cloud Native Core Policy: 1.14.0
Oracle Corporation Communications Diameter Signaling Router (DSR): from 8.0.0 through 8.5.0
Oracle Corporation Communications Pricing Design Center: 12.0.0.3.0
Oracle Corporation Hospitality Cruise Shipboard Property Management System: 20.1.0
Oracle Tekelec Platform Distribution: from 7.4.0 through 7.7.1

How to fix

Upgrade to a fixed version: Apache Tomcat 10.0.6, 7.0.109, 8.5.66, 9.0.46. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-30640 or the next vulnerability affects your stack