UpHeron
All vulnerabilities

Servers and applications

CVE-2021-41079

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.

Severity
High 7.5
Published
16 Sept 2021
Last changed
8 Oct 2026
Added to UpHeron
21 Oct 2026
Fixed in
8.5.64, 9.0.44
Sources
NVD

Affected software

SoftwareAffected versions
Apache TomcatServers and applications · cpe:a:apache:tomcat
  • From 8.5.0 before 8.5.64
  • From 9.0.0 before 9.0.44
  • From 10.0.0 up to 10.0.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-41079
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-41079