CVE-2021-42340

7.5 highEPSS 12%

High (7.5). EPSS 12% chance of exploitation in the next 30 days. Fixed in org.apache.tomcat:tomcat 10.0.12, 10.1.0-M6, 8.5.72.

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 12% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
CWE: CWE-772
Published: 2021-10-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:tomcat
debian:debian_linux
netapp:hci
netapp:management_services_for_element_software
oracle:agile_engineering_data_management
oracle:big_data_spatial_and_graph
oracle:communications_diameter_signaling_router
oracle:hospitality_cruise_shipboard_property_management_system
oracle:managed_file_transfer
oracle:middleware_common_libraries_and_tools
oracle:payment_interface
oracle:retail_customer_insights
oracle:retail_data_extractor_for_merchandising
oracle:retail_eftlink
oracle:retail_financial_integration
oracle:retail_store_inventory_management
oracle:sd-wan_edge
oracle:taleo_platform

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-wph7-x527-w3h5	Maven	org.apache.tomcat:tomcat	>=10.1.0-M1 <10.1.0-M6	10.1.0-M6
GHSA-wph7-x527-w3h5	Maven	org.apache.tomcat:tomcat	>=10.0.0-M1 <10.0.12	10.0.12
GHSA-wph7-x527-w3h5	Maven	org.apache.tomcat:tomcat	>=9.0.40 <9.0.54	9.0.54
GHSA-wph7-x527-w3h5	Maven	org.apache.tomcat:tomcat	>=8.5.60 <8.5.72	8.5.72

References

Check your stack JSON