DEBIAN-CVE-2021-42340

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/DEBIAN-CVE-2021-42340
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2021-42340.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2021-42340
Upstream
Published
2021-10-14T20:15:09Z
Modified
2025-09-19T07:31:50.823311Z
Summary
[none]
Details

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.

References

Affected packages

Debian:11 / tomcat9

Package

Name
tomcat9
Purl
pkg:deb/debian/tomcat9?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.0.43-2~deb11u3

Affected versions

9.*

9.0.43-1
9.0.43-2~deb11u1
9.0.43-2~deb11u2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / tomcat9

Package

Name
tomcat9
Purl
pkg:deb/debian/tomcat9?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.0.54-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / tomcat9

Package

Name
tomcat9
Purl
pkg:deb/debian/tomcat9?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.0.54-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:14 / tomcat9

Package

Name
tomcat9
Purl
pkg:deb/debian/tomcat9?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.0.54-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}