CVE-2021-42340: Missing Release of Resource after Effective Lifetime in Apache Tomcat
Summary
CVE-2021-42340: Missing Release of Resource after Effective Lifetime in Apache Tomcat. Affects org.apache.tomcat:tomcat across 4 version ranges.
>= 8.5.60, < 8.5.72
>= 9.0.40, < 9.0.54
>= 10.0.0-M1, < 10.0.12
>= 10.1.0-M1, < 10.1.0-M6
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
The same CVE-2021-42340 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a robust and scalable platform for hosting web applications and supports the Java Servlet, JavaServer Pages (JSP), and WebSocket technologies. This vulnerability affects versions 8.5.60 to 8.5.71, 9.0.40 to 9.0.53, and 10.0.0-M1 to 10.0.11 of Apache Tomcat. The vulnerability arises from a memory leak introduced in the fix for bug 63362. The object responsible for collecting metrics for HTTP upgrade connections is not released for WebSocket connections after the connection is closed. This can lead to a memory leak over time, potentially resulting in a denial of service through an OutOfMemoryError.
Vulnerability Detail
The vulnerability in Apache Tomcat allows for a memory leak to occur when WebSocket connections are closed. The object used to collect metrics for HTTP upgrade connections is not properly released for WebSocket connections, leading to a gradual accumulation of memory usage. Over time, this can cause an OutOfMemoryError and result in a denial of service. The vulnerability affects multiple versions of Apache Tomcat, including 8.5.60 to 8.5.71, 9.0.40 to 9.0.53, and 10.0.0-M1 to 10.0.11.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 8.5.60, < 8.5.728.5.72 -
>= 9.0.40, < 9.0.549.0.54 -
>= 10.0.0-M1, < 10.0.1210.0.12 -
>= 10.1.0-M1, < 10.1.0-M610.1.0-M6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to upgrade to the latest patched version of Apache Tomcat.
Conclusion
The vulnerability in Apache Tomcat, identified as CVE-2021-42340, can lead to a memory leak and denial of service. It is crucial to upgrade to the latest patched version of Apache Tomcat to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications.
The vulnerability can lead to a memory leak and eventual denial of service through an OutOfMemoryError.
Versions 8.5.60 to 8.5.71, 9.0.40 to 9.0.53, and 10.0.0-M1 to 10.0.11 are affected.
To fix this vulnerability, it is recommended to upgrade to the latest patched version of Apache Tomcat.
No specific workaround is provided. Upgrading to the latest patched version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
