CVE-2021-42340
Estado: ModificadaAlta (7.5)—
The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 7.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 12%
- Percentil entre todas las CVEs puntuadas: 96
- Fecha de la puntuación: 3/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (18)
Apache — TomcatDebian — Debian LinuxNetapp — HCINetapp — Management Services FOR Element SoftwareOracle — Agile Engineering Data ManagementOracle — BIG Data Spatial AND GraphOracle — Communications Diameter Signaling RouterOracle — Hospitality Cruise Shipboard Property Management SystemOracle — Managed File TransferOracle — Middleware Common Libraries AND ToolsOracle — Payment InterfaceOracle — Retail Customer InsightsOracle — Retail Data Extractor FOR MerchandisingOracle — Retail EftlinkOracle — Retail Financial IntegrationOracle — Retail Store Inventory ManagementOracle — Sd-wan EdgeOracle — Taleo Platform
CWE
- CWE-772
- CWE-772
Referencias
- https://kc.mcafee.com/corporate/index?page=content&id=SB10379
- https://lists.apache.org/thread.html/r8097a2d1550aa78e585fc77e602b9046e6d4099d8d132497c5387784%40%3Ccommits.myfaces.apache.org%3E
- https://lists.apache.org/thread.html/r83a35be60f06aca2065f188ee542b9099695d57ced2e70e0885f905c%40%3Cannounce.tomcat.apache.org%3E
- https://security.gentoo.org/glsa/202208-34
- https://security.netapp.com/advisory/ntap-20211104-0001/
- https://www.debian.org/security/2021/dsa-5009
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://kc.mcafee.com/corporate/index?page=content&id=SB10379
- https://lists.apache.org/thread.html/r8097a2d1550aa78e585fc77e602b9046e6d4099d8d132497c5387784%40%3Ccommits.myfaces.apache.org%3E
- https://lists.apache.org/thread.html/r83a35be60f06aca2065f188ee542b9099695d57ced2e70e0885f905c%40%3Cannounce.tomcat.apache.org%3E
- https://security.gentoo.org/glsa/202208-34
- https://security.netapp.com/advisory/ntap-20211104-0001/
- https://www.debian.org/security/2021/dsa-5009
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
JSON original (NVD)
Mostrar
{
"id": "CVE-2021-42340",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "security@apache.org",
"affectedData": [
{
"vendor": "Apache Software Foundation",
"product": "Apache Tomcat",
"versions": [
{
"status": "affected",
"version": "Apache Tomcat 10 10.0.0-M10 to 10.0.11"
},
{
"status": "affected",
"version": "Apache Tomcat 10 10.1.0-M1 to 10.1.0-M5"
},
{
"status": "affected",
"version": "Apache Tomcat 9 9.0.40 to 9.0.53"
},
{
"status": "affected",
"version": "Apache Tomcat 8 8.5.60 to 8.5.71"
}
]
}
]
}
],
"published": "2021-10-14T20:15:09.060",
"references": [
{
"url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10379",
"tags": [
"Third Party Advisory"
],
"source": "security@apache.org"
},
{
"url": "https://lists.apache.org/thread.html/r8097a2d1550aa78e585fc77e602b9046e6d4099d8d132497c5387784%40%3Ccommits.myfaces.apache.org%3E",
"source": "security@apache.org"
},
{
"url": "https://lists.apache.org/thread.html/r83a35be60f06aca2065f188ee542b9099695d57ced2e70e0885f905c%40%3Cannounce.tomcat.apache.org%3E",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"source": "security@apache.org"
},
{
"url": "https://security.gentoo.org/glsa/202208-34",
"tags": [
"Third Party Advisory"
],
"source": "security@apache.org"
},
{
"url": "https://security.netapp.com/advisory/ntap-20211104-0001/",
"tags": [
"Third Party Advisory"
],
"source": "security@apache.org"
},
{
"url": "https://www.debian.org/security/2021/dsa-5009",
"tags": [
"Third Party Advisory"
],
"source": "security@apache.org"
},
{
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html",
"tags": [
"Patch",
"Third Party Advisory"
],
"source": "security@apache.org"
},
{
"url": "https://www.oracle.com/security-alerts/cpujan2022.html",
"tags": [
"Patch",
"Third Party Advisory"
],
"source": "security@apache.org"
},
{
"url": "https://www.oracle.com/security-alerts/cpujul2022.html",
"tags": [
"Patch",
"Third Party Advisory"
],
"source": "security@apache.org"
},
{
"url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10379",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.apache.org/thread.html/r8097a2d1550aa78e585fc77e602b9046e6d4099d8d132497c5387784%40%3Ccommits.myfaces.apache.org%3E",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.apache.org/thread.html/r83a35be60f06aca2065f188ee542b9099695d57ced2e70e0885f905c%40%3Cannounce.tomcat.apache.org%3E",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.gentoo.org/glsa/202208-34",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.netapp.com/advisory/ntap-20211104-0001/",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.debian.org/security/2021/dsa-5009",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html",
"tags": [
"Patch",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.oracle.com/security-alerts/cpujan2022.html",
"tags": [
"Patch",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.oracle.com/security-alerts/cpujul2022.html",
"tags": [
"Patch",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "security@apache.org",
"description": [
{
"lang": "en",
"value": "CWE-772"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-772"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError."
},
{
"lang": "es",
"value": "La corrección del bug 63362 presente en Apache Tomcat versiones 10.1.0-M1 hasta 10.1.0-M5, versiones 10.0.0-M1 hasta 10.0.11, versiones 9.0.40 hasta 9.0.53 y versiones 8.5.60 hasta 8.5.71, introducía una pérdida de memoria. El objeto introducido para recopilar métricas para las conexiones de actualización HTTP no se liberaba para las conexiones WebSocket una vez que se cerraba la conexión. Esto creaba una pérdida de memoria que, con el tiempo, podía conllevar a una denegación de servicio por medio de un OutOfMemoryError"
}
],
"lastModified": "2026-06-17T04:09:40.450",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "890E6FBC-FCC5-44B0-8CE8-AD7E8F0A1BFA",
"versionEndExcluding": "8.5.72",
"versionStartIncluding": "8.5.60"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "654BD045-868C-4DC0-B36C-824C0F4C41CD",
"versionEndExcluding": "9.0.54",
"versionStartIncluding": "9.0.40"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1C639222-18E7-4BDC-A53A-684F63C42991",
"versionEndExcluding": "10.0.12",
"versionStartIncluding": "10.0.1"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:10.0.0:milestone10:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "83B9FF07-1B93-4F8C-AC56-7CA74E61B724"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6D402B5D-5901-43EB-8E6A-ECBD512CE367"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9846609D-51FC-4CDD-97B3-8C6E07108F14"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2E321FB4-0B0C-497A-BB75-909D888C93CB"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3B0CAE57-AF7A-40E6-9519-F5C9F422C1BE"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7CB9D150-EED6-4AE9-BCBE-48932E50035E"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8A6E548F-62E9-40CB-85DA-FDAA0F0096C6"
},
{
"criteria": "cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "86B51137-28D9-41F2-AFA2-3CC22B4954D1"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "80C9DBB8-3D50-4D5D-859A-B022EB7C2E64"
},
{
"criteria": "cpe:2.3:a:oracle:big_data_spatial_and_graph:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "384DEDD9-CB26-4306-99D8-83068A9B23ED",
"versionEndExcluding": "23.1"
},
{
"criteria": "cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "590ADE5F-0D0F-4576-8BA6-828758823442",
"versionEndIncluding": "8.5.0.2",
"versionStartIncluding": "8.0.0.0"
},
{
"criteria": "cpe:2.3:a:oracle:hospitality_cruise_shipboard_property_management_system:20.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "05F5B430-8BA1-4865-93B5-0DE89F424B53"
},
{
"criteria": "cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A2E3E923-E2AD-400D-A618-26ADF7F841A2"
},
{
"criteria": "cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9AB58D27-37F2-4A32-B786-3490024290A1"
},
{
"criteria": "cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9AB179A8-DFB7-4DCF-8DE3-096F376989F1"
},
{
"criteria": "cpe:2.3:a:oracle:payment_interface:19.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5D01A0EC-3846-4A74-A174-3797078DC699"
},
{
"criteria": "cpe:2.3:a:oracle:payment_interface:20.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "03E5FCFB-093A-48E9-8A4E-34C993D2764E"
},
{
"criteria": "cpe:2.3:a:oracle:retail_customer_insights:15.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3D1C35DF-D30D-42C8-B56D-C809609AB2A4"
},
{
"criteria": "cpe:2.3:a:oracle:retail_customer_insights:16.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "834B4CE7-042E-489F-AE19-0EEA2C37E7A8"
},
{
"criteria": "cpe:2.3:a:oracle:retail_data_extractor_for_merchandising:15.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "82653579-FF7D-4492-9CA2-B3DF6A708831"
},
{
"criteria": "cpe:2.3:a:oracle:retail_data_extractor_for_merchandising:16.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "32D2EB48-F9A2-4D23-81C5-4B30F2D785DF"
},
{
"criteria": "cpe:2.3:a:oracle:retail_eftlink:21.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F4B95628-F108-424A-8C19-40A5F5B7D37B"
},
{
"criteria": "cpe:2.3:a:oracle:retail_financial_integration:16.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EE6D2296-FF70-462A-963D-C93429499E4F"
},
{
"criteria": "cpe:2.3:a:oracle:retail_financial_integration:19.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4B7B0B33-2361-4CF5-8075-F609858A582E"
},
{
"criteria": "cpe:2.3:a:oracle:retail_store_inventory_management:14.0.4.13:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "88458537-6DE8-4D79-BC71-9D08883AD0C1"
},
{
"criteria": "cpe:2.3:a:oracle:retail_store_inventory_management:14.1.3.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2E310654-0793-41CC-B049-C754AC31D016"
},
{
"criteria": "cpe:2.3:a:oracle:retail_store_inventory_management:14.1.3.14:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4C5B22C6-97AF-4D1B-84C9-987C6F62C401"
},
{
"criteria": "cpe:2.3:a:oracle:retail_store_inventory_management:15.0.3.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FFD9AAE5-9472-49C6-B054-DB76BEB86D35"
},
{
"criteria": "cpe:2.3:a:oracle:retail_store_inventory_management:15.0.3.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A104FDBD-0B28-44EE-91A0-A0C8939865A3"
},
{
"criteria": "cpe:2.3:a:oracle:retail_store_inventory_management:16.0.3.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C2D60A4D-BB4F-4177-AFA8-A8DC8C111FB3"
},
{
"criteria": "cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "77E39D5C-5EFA-4FEB-909E-0A92004F2563"
},
{
"criteria": "cpe:2.3:a:oracle:sd-wan_edge:9.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "06816711-7C49-47B9-A9D7-FB18CC3F42F2"
},
{
"criteria": "cpe:2.3:a:oracle:taleo_platform:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "10009CC2-04DD-4CD3-B256-2D5EFD9A1D1D"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security@apache.org"
}