CVE-2021-41079: Apache Tomcat DoS with unexpected TLS packet

Published Sep 15, 2021
·
Updated

A flaw was found in Apache Tomcat. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet can trigger an infinite loop, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

Other sources

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.

Apache Tomcat did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service. This issue affects the version of Apache Tomcat 10.0.0-M1 to 10.0.2; 9.0.0-M1 to 9.0.43; 8.5.0 to 8.5.63.

Upstream commits: Tomcat 10.0.4: https://github.com/apache/tomcat/commit/34115fb3c83f6cd97772232316a492a4cc5729e0 Tomcat 9.0.44: https://github.com/apache/tomcat/commit/d4b340fa8feaf55831f9a59350578f7b6ca048b8 Tomcat 8.5.64: https://github.com/apache/tomcat/commit/b90d4fc1ff44f30e4b3aba622ba6677e3f003822

Reference: https://lists.apache.org/thread.html/rccdef0349fdf4fb73a4e4403095446d7fe6264e0a58e2df5c6799434%40%3Cannounce.tomcat.apache.org%3E

Red Hat

Apache Tomcat is vulnerable to a denial of service, caused by improper input validation of TLS packets. By sending a specially-crafted TLS packet, a remote attacker could exploit this vulnerability to cause the application to enter into an infinite loop.

IBM

Affected Software

14 affected componentsFixes available
redhat/jws5-tomcat<0:9.0.43-13.redhat_00013.1.el7
0:9.0.43-13.redhat_00013.1.el7
redhat/jws5-tomcat<0:9.0.43-13.redhat_00013.1.el8
0:9.0.43-13.redhat_00013.1.el8
redhat/tomcat<10.0.4
10.0.4
redhat/tomcat<9.0.44
9.0.44
redhat/tomcat<8.5.64
8.5.64
IBM DRM<=2.0.6
Apache Tomcat>=8.5.0<8.5.64
Apache Tomcat>=9.0.0<9.0.44
Apache Tomcat>=10.0.0<=10.0.2
Debian Debian Linux=9.0
Debian Debian Linux=10.0
Debian Debian Linux=11.0
NetApp Management Services For Element Software And Netapp Hci
debian/tomcat9
9.0.43-2~deb11u109.0.43-2~deb11u129.0.70-29.0.95-1

Event History

Sep 15, 2021
CVE Published
12:00 AM
Sep 16, 2021
Data Sourced
via Red Hat·06:17 AM
DescriptionSeverityAffected Software
CVE Published
via MITRE·02:40 PM
Data Sourced
via MITRE·02:40 PM
DescriptionWeakness
Jan 12, 2024
Data Sourced
via Launchpad·12:00 AM
Description
Sep 16, 2024
Data Sourced
via Ubuntu·02:35 AM
RemedyDescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the vulnerability ID?

The vulnerability ID is CVE-2021-41079.

2

What is the severity of CVE-2021-41079?

The severity of CVE-2021-41079 is high with a CVSS score of 7.5.

3

What is the affected software?

The affected software includes Apache Tomcat versions 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43, and 10.0.0-M1 to 10.0.2.

4

How can I fix CVE-2021-41079?

To fix CVE-2021-41079, you need to update Apache Tomcat to version 10.0.4, 9.0.44, or 8.5.64, depending on the version you are using.

5

Where can I find more information about CVE-2021-41079?

You can find more information about CVE-2021-41079 in the references section.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203