NetSight
IP …
high7.5

CVE-2021-42340

Missing Release of Resource after Effective Lifetime in Apache Tomcat

Impact

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.tomcat:tomcat>= 10.1.0-M1, <= 10.1.0-M510.1.0-M6

Affected products

VendorProductAffected versions
ApacheTomcat
from 8.5.60 before 8.5.72
from 9.0.40 before 9.0.54
from 10.0.1 before 10.0.12
Versions 10.0.0, 10.1.0
NetappHci
All versions
NetappManagement Services For Element Software
All versions
DebianDebian Linux
Version 11.0
OracleAgile Engineering Data Management
Version 6.2.1.0
OracleBig Data Spatial And Graph
before 23.1
OracleCommunications Diameter Signaling Router
from 8.0.0.0 through 8.5.0.2
OracleHospitality Cruise Shipboard Property Management System
Version 20.1.0
OracleManaged File Transfer
Versions 12.2.1.3.0, 12.2.1.4.0
OracleMiddleware Common Libraries And Tools
Version 12.2.1.4.0
OraclePayment Interface
Versions 19.1, 20.3
OracleRetail Customer Insights
Versions 15.0.2, 16.0.2

Weakness classification

CWE-772

References