UpHeron
All vulnerabilities

Servers and applications

CVE-2021-42340

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an…

Severity
High 7.5
Published
14 Oct 2021
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
8.5.72, 9.0.54, 10.0.12
Sources
NVD

Affected software

SoftwareAffected versions
Apache TomcatServers and applications · cpe:a:apache:tomcat
  • Version 10.1.0-milestone5
  • Version 10.1.0-milestone4
  • Version 10.1.0-milestone3
  • Version 10.1.0-milestone2
All 9 release lines
  • From 8.5.60 before 8.5.72
  • From 9.0.40 before 9.0.54
  • Version 10.0.0-milestone10
  • From 10.0.1 before 10.0.12
  • Version 10.1.0-milestone1
  • Version 10.1.0-milestone2
  • Version 10.1.0-milestone3
  • Version 10.1.0-milestone4
  • Version 10.1.0-milestone5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-42340
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-42340