Skip to main content

CVE-2021-41079

Severity

7.5

Description

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.

Mitigation

We recommend upgrading to a version of this component that is not vulnerable to this specific issue.

Note: If this component is included as a bundled/transitive dependency of another component, there may not be an upgrade path. In this instance, we recommend contacting the maintainers who included the vulnerable package. Alternatively, we recommend investigating alternative components or a potential mitigating control.

Project

Apache Tomcat

Apache TomEE

Category
CWE-20 Improper Input Validation
Tags
data
operational
configuration
Date Disclosed

2021-09-16

Date Discovered

2021-09-15

Feel Vulnerable? 

Contact us so we can help you.

* These fields are required.