{"id":"CVE-2021-41079","published":"2021-09-16T14:40:25Z","modified":"2026-10-08T21:13:52Z","title":"Apache Tomcat DoS with unexpected TLS packet","vendor":"Apache","product":"Apache Tomcat","tier":"tail","description":{"text":"Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.07182,"percentile":0.94276,"provenance":"source"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://lists.apache.org/thread.html/rccdef0349fdf4fb73a4e4403095446d7fe6264e0a58e2df5c6799434%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/09/msg00012.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://security.netapp.com/advisory/ntap-20211008-0005/","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.apache.org/thread.html/rb4de81ac647043541a32881099aa6eb5a23f1b7fd116f713f8ab9dbe%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r6b6b674e3f168dd010e67dbe6848b866e2acf26371452fdae313b98a%40%3Cusers.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.debian.org/security/2021/dsa-4986","tags":["vendor-advisory","x_refsource_DEBIAN"]}],"priority":{"score":18.9,"factors":[{"name":"EPSS percentile","points":18.86}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":["Apache Tomcat 8.5 8.5.0 to 8.5.63","Apache Tomcat 9 9.0.0-M1 to 9.0.43","Apache Tomcat 10 10.0.0-M1 to 10.0.2"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=10.0.0, <10.0.4",">=9.0.0, <9.0.44",">=8.5.0, <8.5.64"],"patched":["10.0.4","9.0.44","8.5.64"],"from":["GHSA-59g9-7gfx-c72p"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1985","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-11996","published":"2020-06-26","fixed":"10.0.0-M5","kev":false},{"cve":"CVE-2020-13934","published":"2020-07-14","fixed":"10.0.0-M6","kev":false},{"cve":"CVE-2020-13935","published":"2020-07-14","fixed":"10.0.0-M7","kev":false,"link":{"from":"CVE-2020-13935","to":"CVE-2021-41079","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"9.0.37","toFixed":"9.0.44","daysApart":429},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"8.5.57","toFixed":"8.5.64","daysApart":429}]}},{"cve":"CVE-2021-41079","published":"2021-09-16","fixed":"10.0.4","kev":false},{"cve":"CVE-2021-30639","published":"2021-07-12","fixed":"10.0.5","kev":false},{"cve":"CVE-2021-30640","published":"2021-07-12","fixed":"10.0.5","kev":false},{"cve":"CVE-2021-33037","published":"2021-07-12","fixed":"10.0.7","kev":false}],"package":"Maven:org.apache.tomcat:tomcat"}}