CVE-2021-41079

mediumPriorität · verfolgen · 33EPSS 0.072 · 94. PerzentilDEEUNLRUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

7.18% (94th) EPSS

CVSS 4.3 · medium

Is it mine?

118 products

Prüfe deine Angriffsfläche

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-22

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobentomcat-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-admin-webapps-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-admin-webapps-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-docs-webapp-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-docs-webapp-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-el-3_0-api-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-el-3_0-api-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-javadoc-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-javadoc-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-jsp-2_3-api-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-jsp-2_3-api-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-lib-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-lib-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-servlet-4_0-api-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-servlet-4_0-api-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-webapps-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-webapps-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.5

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 4.3–7.5

v2.04.3mediumAV:N/AC:M/Au:N/C:N/I:N/A:Pprimary · NVD / NIST USAusnutzbarkeit 8.6 · Auswirkung 2.9

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 3.6

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · OSV

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · SUSE Product Security

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · NCSC-NL NL

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-835USprimärCWE-20USCWE-20USCWE-20USCWE-400USCWE-835US

betroffene Produkte (118)

Betroffene Produkte und Versionsbereiche.

Atlassian Bitbucket <10.0.2alle Versionencert_bundDE
Atlassian Bitbucket <8.19.25 (LTS)alle Versionencert_bundDE
Atlassian Bitbucket <9.4.13 (LTS)alle Versionencert_bundDE
Debian Linuxalle Versionencert_bundDEcpe:/o:debian:debian_linux:-
EMC Avamaralle Versionencert_bundDEcpe:/a:emc:avamar:-
Hitachi Ops Centeralle Versionencert_bundDEcpe:/a:hitachi:ops_center:-
IBM Operational Decision Manageralle Versionencert_bundDEcpe:/a:ibm:operational_decision_manager:-
IBM QRadar SIEMalle Versionencert_bundDEcpe:/a:ibm:qradar_siem:-
IBM QRadar SIEM 7.4alle Versionencert_bundDEcpe:/a:ibm:qradar_siem:7.4
IBM QRadar SIEM 7.5alle Versionencert_bundDEcpe:/a:ibm:qradar_siem:7.5
IBM Spectrum Protect plus 10.1alle Versionencert_bundDEcpe:/a:ibm:spectrum_protect:plus_10.1
NetApp ActiveIQ Unified Manageralle Versionencert_bundDEcpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~
Red Hat Enterprise Linuxalle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat FUSE <7.11.0alle Versionencert_bundDE
Red Hat JBoss Enterprise Application Platform <7.1.10alle Versionencert_bundDE
Red Hat JBoss Enterprise Application Platform <7.3.13alle Versionencert_bundDE
Atlassian Bitbucket< 10.0.2cert_bundDE
Atlassian Bitbucket< 8.19.25 (LTS)cert_bundDE
Atlassian Bitbucket< 9.4.13 (LTS)cert_bundDE
Red Hat Fuse< 7.11.0cert_bundDE

20 von 118 angezeigt

Advisories (7)

Hersteller- und Ökosystem-Meldungen dazu.

NCSC-2025-0123Kwetsbaarheden verholpen in Oracle Database ProductenNL2025-04-16csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in diverse Oracle Database Producten en subsystemen, zoals Oracle Server, NoSQL, TimesTen, Secure Backup en Essbase.
SUSE-SU-2026:1058-1Security update for tomcat2026-03-26csaf · suse_csafDE
Security update for tomcat
WID-SEC-W-2022-0607Red Hat FUSE: Mehrere SchwachstellenDeutsch2022-07-07csaf · cert_bundDE
Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Red Hat FUSE ausnutzen, um vertrauliche Informationen offenzulegen, beliebigen Code auszuführen, einen Denial of Service Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen, Daten und Informationen zu manipulieren und seine Privilegien zu erweitern.
WID-SEC-W-2024-0673Apache Tomcat: Schwachstelle ermöglicht Denial of ServiceDeutsch2021-09-15csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache Tomcat ausnutzen, um einen Denial of Service Angriff durchzuführen.
WID-SEC-W-2024-1238HPE HP-UX: Mehrere SchwachstellenDeutsch2024-05-27csaf · cert_bundDE
Ein anonymer oder lokaler Angreifer kann mehrere Schwachstellen in HPE HP-UX Tomcat Servlet Engine ausnutzen, um Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen oder Dateien zu manipulieren.
GHSA-59g9-7gfx-c72pInfinite loop in Tomcat due to parsing error2021-09-20ghsa · osvUS
Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.
BIT-tomcat-2021-41079Apache Tomcat DoS with unexpected TLS packet2024-03-06vendor · osvUS
Apache Tomcat 8.5.0 to 8.5.63, 9.0.0 to 9.0.43 and 10.0.0 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.

auch bekannt als (6)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu osv cert_bund ncsc_nl suse_csaf NVD CVE.org MITRE

veröffentlicht 2021-09-16geändert 2026-06-17

verwandt (1,368)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2024-20353US	high8.6OT kritisch	70.7% (99th)	KEV	2024-04-24
A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthen…
CVE-2020-13935US	high7.5	86.6% (100th)	Exploit	2020-07-14
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payl…
CVE-2014-0050US	high7.5	83.3% (100th)	Exploit	2014-04-01
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infin…
CVE-2021-21341US	high7.5	77.8% (100th)	Exploit	2021-03-23
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CP…
CVE-2022-0778US	high7.5	73.2% (99th)	Exploit	2022-03-15
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsi…

+1363 weitere

Referenzen (37)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan