CVE-2021-42340

Description

The fix for bug 63362 present in Apache Tomcat 10.1.0 to 10.1.0, 10.0.0 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.

How to fix CVE-2021-42340

To remediate CVE-2021-42340, upgrade the affected package to a fixed version below.

• —upgrade to 8.5.72 or later
• —upgrade to 9.0.43-2~deb11u3 or later
• —upgrade to 9.0.43-2~deb11u3 or later
• —upgrade to 10.1.0-M6 or later

Is CVE-2021-42340 being exploited?

Moderate — EPSS is 11.0%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (4)

• >= 8.5.60, < 8.5.72, >= 9.0.40, < 9.0.54, >= 10.0.1, < 10.0.12
• from 0, < 9.0.43-2~deb11u3
• from 0, < 9.0.43-2~deb11u3
• >= 10.1.0-M1, < 10.1.0-M6

CVSS scores

References (21)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-42340
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2021-42340
• PATCHgithub.com/apache/tomcat
• WEBgithub.com/apache/tomcat/commit/31d62426645824bdfe076a0c0eafa904d90b4fb9