Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-43980

The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.

Published

2022-09-28T14:15:09.880

Last Modified

2025-05-21T15:15:55.223

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 3.7 (LOW)

Weaknesses
  • Type: Secondary
    CWE-362
  • Type: Secondary
    CWE-362
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application apache tomcat ≤ 8.5.77 Yes
Application apache tomcat ≤ 9.0.60 Yes
Application apache tomcat ≤ 10.0.18 Yes
Application apache tomcat 10.1.0 Yes
Application apache tomcat 10.1.0 Yes
Application apache tomcat 10.1.0 Yes
Application apache tomcat 10.1.0 Yes
Application apache tomcat 10.1.0 Yes
Application apache tomcat 10.1.0 Yes
Application apache tomcat 10.1.0 Yes
Application apache tomcat 10.1.0 Yes
Application apache tomcat 10.1.0 Yes
Application apache tomcat 10.1.0 Yes
Application apache tomcat 10.1.0 Yes
Application apache tomcat 10.1.0 Yes
Operating System debian debian_linux 10.0 Yes
Operating System debian debian_linux 11.0 Yes
References