Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade tomcat8 | Nov 5, 2021 | Sep 16, 2021 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 8.5.64Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 9.0.44Upgrade Apache Tomcat to 10.0.2 | Sep 16, 2021 | Sep 16, 2021 |
| Debian | — | Upgrade tomcat9 | Sep 24, 2021 | Sep 16, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-jsp-2.3-apiUpgrade tomcatUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-el-3.0-apiUpgrade tomcat-servlet-4.0-api | Dec 28, 2021 | Sep 16, 2021 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8 to version 8.5.64-11.4.32.0.1.88.2 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.64-11.4.32.0.1.88.2 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.64-11.4.32.0.1.88.2 on Solaris 11.4 | Oct 12, 2021 | Sep 16, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 16, 2021 |
| Suse | — | Upgrade tomcat-javadocUpgrade tomcat-jsvcUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-el-3_0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-embedUpgrade javapackages-toolsUpgrade tomcat-libUpgrade tomcat-jsp-2_3-api | Nov 4, 2021 | Sep 16, 2021 |
| Ubuntu | — | Upgrade tomcat8-docs (Ubuntu Pro)Upgrade tomcat9-commonUpgrade libtomcat9-java (Ubuntu Pro)Upgrade tomcat8 (Ubuntu Pro)Upgrade tomcat9Upgrade tomcat9-docs (Ubuntu Pro)Upgrade libtomcat9-embed-javaUpgrade tomcat9 (Ubuntu Pro)Upgrade libtomcat8-java (Ubuntu Pro)Upgrade libtomcat9-java | Apr 1, 2022 | Sep 16, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 16, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub