CVE-2021-30639

A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS. Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.

Weakness

The product does not handle or incorrectly handles an exceptional condition.

Affected Software

Name	Vendor	Start Version	End Version
Tomcat	Apache	8.5.64 (including)	8.5.64 (including)
Tomcat	Apache	9.0.44 (including)	9.0.44 (including)
Tomcat	Apache	10.0.3 (including)	10.0.3 (including)
Tomcat	Apache	10.0.4 (including)	10.0.4 (including)
Tomcat6	Ubuntu	trusty	*
Tomcat6	Ubuntu	trusty/esm	*
Tomcat6	Ubuntu	xenial	*
Tomcat7	Ubuntu	bionic	*
Tomcat7	Ubuntu	trusty	*
Tomcat7	Ubuntu	trusty/esm	*
Tomcat7	Ubuntu	xenial	*
Tomcat8	Ubuntu	bionic	*
Tomcat8	Ubuntu	upstream	*
Tomcat8	Ubuntu	xenial	*
Tomcat9	Ubuntu	bionic	*
Tomcat9	Ubuntu	focal	*
Tomcat9	Ubuntu	groovy	*
Tomcat9	Ubuntu	hirsute	*
Tomcat9	Ubuntu	impish	*
Tomcat9	Ubuntu	kinetic	*
Tomcat9	Ubuntu	lunar	*
Tomcat9	Ubuntu	mantic	*
Tomcat9	Ubuntu	oracular	*
Tomcat9	Ubuntu	upstream	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2021-30639
CWE	https://cwe.mitre.org/data/definitions/755.html

Improper Handling of Exceptional Conditions

Weakness

Affected Software

References