Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | amazon-linux-upgrade-tomcat8 | Nov 5, 2021 | Sep 16, 2021 |
| Apache Tomcat | apache-tomcat-upgrade-8_5_64apache-tomcat-upgrade-9_0_44apache-tomcat-upgrade-10_0_2apache-tomcat-10_0apache-tomcat-8_5apache-tomcat-9_0apache-tomcat-upgrade-latest | Sep 16, 2021 | Sep 16, 2021 | |
| Debian | debian-upgrade-tomcat9 | Sep 24, 2021 | Sep 16, 2021 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-tomcathuawei-euleros-2_0_sp8-upgrade-tomcat-admin-webappshuawei-euleros-2_0_sp8-upgrade-tomcat-el-3.0-apihuawei-euleros-2_0_sp8-upgrade-tomcat-jsp-2.3-apihuawei-euleros-2_0_sp8-upgrade-tomcat-libhuawei-euleros-2_0_sp8-upgrade-tomcat-servlet-4.0-api | Dec 28, 2021 | Sep 16, 2021 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-web-java-servlet-tomcat-8-8-5-64-11-4-32-0-1-88-2oracle-solaris-11-4-upgrade-web-java-servlet-tomcat-8-tomcat-admin-8-5-64-11-4-32-0-1-88-2oracle-solaris-11-4-upgrade-web-java-servlet-tomcat-8-tomcat-examples-8-5-64-11-4-32-0-1-88-2 | Oct 12, 2021 | Sep 16, 2021 | |
| Redhat_linux | — | no-fix-redhat-rpm-package | Jul 9, 2025 | Sep 16, 2021 |
| Suse | — | suse-upgrade-javapackages-toolssuse-upgrade-tomcatsuse-upgrade-tomcat-admin-webappssuse-upgrade-tomcat-docs-webappsuse-upgrade-tomcat-el-3_0-apisuse-upgrade-tomcat-embedsuse-upgrade-tomcat-javadocsuse-upgrade-tomcat-jsp-2_3-apisuse-upgrade-tomcat-jsvcsuse-upgrade-tomcat-libsuse-upgrade-tomcat-servlet-4_0-apisuse-upgrade-tomcat-webapps | Nov 4, 2021 | Sep 16, 2021 |
| Ubuntu | ubuntu-pro-upgrade-libtomcat8-javaubuntu-pro-upgrade-libtomcat9-javaubuntu-pro-upgrade-tomcat8ubuntu-pro-upgrade-tomcat8-docsubuntu-pro-upgrade-tomcat9ubuntu-pro-upgrade-tomcat9-docsubuntu-upgrade-libtomcat9-embed-javaubuntu-upgrade-libtomcat9-javaubuntu-upgrade-tomcat9ubuntu-upgrade-tomcat9-common | Apr 1, 2022 | Sep 16, 2021 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Sep 16, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub