{"id":"CVE-2021-30639","published":"2021-07-12T14:55:12Z","modified":"2024-08-03T22:40:31Z","title":"DoS after non-blocking IO error","vendor":"Apache","product":"Apache Tomcat","tier":"tail","description":{"text":"A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS. Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.06889,"percentile":0.94025,"provenance":"source"},"cwes":[],"references":[{"url":"https://lists.apache.org/thread.html/rd84fae1f474597bdf358f5bdc0a5c453c507bd527b83e8be6b5ea3f4%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC"]},{"url":"https://lists.apache.org/thread.html/r79a7c019712b39aedf7cf4da9276d80610f04441b2a4f6506cb2daaf%40%3Cusers.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r79a7c019712b39aedf7cf4da9276d80610f04441b2a4f6506cb2daaf%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://security.netapp.com/advisory/ntap-20210827-0007/","tags":["x_refsource_CONFIRM"]},{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10366","tags":["x_refsource_CONFIRM"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC"]},{"url":"https://security.gentoo.org/glsa/202208-34","tags":["vendor-advisory","x_refsource_GENTOO"]}],"priority":{"score":18.8,"factors":[{"name":"EPSS percentile","points":18.8}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":["Apache Tomcat 10 10.0.3 to 10.0.4","Apache Tomcat 9 9.0.44","Apache Tomcat 8.5 8.5.64"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=10.0.3, <10.0.5",">=9.0.0, <9.0.45","<8.5.65"],"patched":["10.0.5","9.0.45","8.5.65"],"from":["GHSA-44qp-qhfv-c7f6"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1554","exploited":false,"provenance":"source"}}