CVE-2021-42340: Apache Tomcat

High severity, CVSS 7.5. EPSS: 11.8% chance of exploitation in the next 30 days.

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.

Affected products

Apache Tomcat: from 8.5.60, before 8.5.72 (fixed in 8.5.72); from 9.0.40, before 9.0.54 (fixed in 9.0.54); from 10.0.1, before 10.0.12 (fixed in 10.0.12); version 10.0.0 only; version 10.1.0 only
Debian Debian Linux: version 11.0 only
Netapp Hci: affected versions not specified
Netapp Management Services For Element Software: affected versions not specified
Oracle Agile Engineering Data Management: version 6.2.1.0 only
Oracle Big Data Spatial And Graph: before 23.1 (fixed in 23.1)
Oracle Communications Diameter Signaling Router: from 8.0.0.0, up to and including 8.5.0.2
Oracle Hospitality Cruise Shipboard Property Management System: version 20.1.0 only
Oracle Managed File Transfer: version 12.2.1.3.0 only; version 12.2.1.4.0 only
Oracle Middleware Common Libraries And Tools: version 12.2.1.4.0 only
Oracle Payment Interface: version 19.1 only; version 20.3 only
Oracle Retail Customer Insights: version 15.0.2 only; version 16.0.2 only
Oracle Retail Data Extractor For Merchandising: version 15.0.2 only; version 16.0.2 only
Oracle Retail Eftlink: version 21.0.0 only
Oracle Retail Financial Integration: version 16.0.1 only; version 19.0.0 only
Oracle Retail Store Inventory Management: version 14.0.4.13 only; version 14.1.3.5 only; version 14.1.3.14 only; version 15.0.3.3 only; version 15.0.3.8 only; version 16.0.3.7 only
Oracle SD-WAN Edge: version 9.0 only; version 9.1 only
Oracle Taleo Platform: any version

Published 2021-10-14. Last modified 2026-06-17.