What’s Vulnerable › Vulnerabilities

CVE-2021-42340: DoS via memory leak with WebSocket connections

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 11.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-10-14 · updated 2026-06-17
• Weakness: CWE-772

Description

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.

Affected products

• Apache Tomcat: from 8.5.60 before 8.5.72; from 9.0.40 before 9.0.54; from 10.0.1 before 10.0.12; 10.0.0-milestone10, 10.1.0-milestone1, 10.1.0-milestone2, 10.1.0-milestone3, 10.1.0-milestone4, 10.1.0-milestone5 — fixed in 10.0.12, 8.5.72, 9.0.54
• Debian Linux: 11.0
• NetApp Hci: all versions
• NetApp Management Services For Element Software: all versions
• Oracle Corporation Oracle Agile Engineering Data Management: 6.2.1.0
• Oracle Big Data Spatial And Graph: before 23.1 — fixed in 23.1
• Oracle Corporation Communications Diameter Signaling Router (DSR): from 8.0.0.0 through 8.5.0.2
• Oracle Corporation Hospitality Cruise Shipboard Property Management System: 20.1.0
• Oracle Corporation Oracle Managed File Transfer: 12.2.1.3.0, 12.2.1.4.0
• Oracle Middleware Common Libraries And Tools: 12.2.1.4.0
• Oracle Corporation Payment Gateway Services: 19.1, 20.3
• Oracle Retail Customer Insights: 15.0.2, 16.0.2
• Oracle Retail Data Extractor For Merchandising: 15.0.2, 16.0.2
• Oracle Corporation Oracle Retail EFTLink: 21.0.0
• Oracle Retail Financial Integration: 16.0.1, 19.0.0
• Oracle Corporation Retail Store Inventory Management: 14.0.4.13, 14.1.3.5, 14.1.3.14, 15.0.3.3, 15.0.3.8, 16.0.3.7
• Oracle Corporation SD-WAN Edge: 9.0, 9.1
• Oracle Taleo Platform: all versions

How to fix

Upgrade to a fixed version: Apache Tomcat 10.0.12, 8.5.72, 9.0.54; Oracle Big Data Spatial And Graph 23.1. Check the vendor advisory for mitigations.

References

• https://kc.mcafee.com/corporate/index?page=content&id=SB10379
• https://lists.apache.org/thread.html/r8097a2d1550aa78e585fc77e602b9046e6d4099d8d132497c5387784%40%3Ccommits.myfaces.apache.org%3E
• https://lists.apache.org/thread.html/r83a35be60f06aca2065f188ee542b9099695d57ced2e70e0885f905c%40%3Cannounce.tomcat.apache.org%3E
• https://security.gentoo.org/glsa/202208-34
• https://security.netapp.com/advisory/ntap-20211104-0001/
• https://www.debian.org/security/2021/dsa-5009
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://kc.mcafee.com/corporate/index?page=content&id=SB10379
• https://lists.apache.org/thread.html/r8097a2d1550aa78e585fc77e602b9046e6d4099d8d132497c5387784%40%3Ccommits.myfaces.apache.org%3E
• https://lists.apache.org/thread.html/r83a35be60f06aca2065f188ee542b9099695d57ced2e70e0885f905c%40%3Cannounce.tomcat.apache.org%3E

Get alerted when CVE-2021-42340 or the next vulnerability affects your stack