Vulnerabilities > CVE-2021-41079 - Infinite Loop vulnerability in multiple products

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

NVD

Published: 2021-09-16

Updated: 2023-11-07

Summary

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.

Vulnerable Configurations

Part	Description	Count
Application	Apache Apache Tomcat 10.0.0 Apache Tomcat 10.0.1 Apache Tomcat 10.0.2 Apache Tomcat 9.0.0 Apache Tomcat 9.0.1 Apache Tomcat 9.0.2 Apache Tomcat 9.0.3 Apache Tomcat 9.0.4 Apache Tomcat 9.0.5 Apache Tomcat 9.0.6 Apache Tomcat 9.0.7 Apache Tomcat 9.0.8 Apache Tomcat 9.0.9 Apache Tomcat 9.0.10 Apache Tomcat 9.0.11 Apache Tomcat 9.0.12 Apache Tomcat 9.0.13 Apache Tomcat 9.0.14 Apache Tomcat 9.0.15 Apache Tomcat 9.0.16 Apache Tomcat 9.0.17 Apache Tomcat 9.0.18 Apache Tomcat 9.0.19 Apache Tomcat 9.0.20 Apache Tomcat 9.0.21 Apache Tomcat 9.0.22 Apache Tomcat 9.0.23 Apache Tomcat 9.0.24 Apache Tomcat 9.0.25 Apache Tomcat 9.0.26 Apache Tomcat 9.0.27 Apache Tomcat 9.0.28 Apache Tomcat 9.0.29 Apache Tomcat 9.0.30 Apache Tomcat 9.0.31 Apache Tomcat 9.0.32 Apache Tomcat 9.0.33 Apache Tomcat 9.0.34 Apache Tomcat 9.0.35 Apache Tomcat 9.0.35-3.39.1 Apache Tomcat 9.0.35-3.57.3 Apache Tomcat 9.0.36 Apache Tomcat 9.0.37 Apache Tomcat 9.0.38 Apache Tomcat 9.0.39 Apache Tomcat 9.0.40 Apache Tomcat 9.0.41 Apache Tomcat 9.0.42 Apache Tomcat 9.0.43 Apache Tomcat 8.5.0 Apache Tomcat 8.5.1 Apache Tomcat 8.5.2 Apache Tomcat 8.5.3 Apache Tomcat 8.5.4 Apache Tomcat 8.5.5 Apache Tomcat 8.5.6 Apache Tomcat 8.5.7 Apache Tomcat 8.5.8 Apache Tomcat 8.5.9 Apache Tomcat 8.5.10 Apache Tomcat 8.5.11 Apache Tomcat 8.5.12 Apache Tomcat 8.5.13 Apache Tomcat 8.5.14 Apache Tomcat 8.5.15 Apache Tomcat 8.5.16 Apache Tomcat 8.5.17 Apache Tomcat 8.5.18 Apache Tomcat 8.5.19 Apache Tomcat 8.5.20 Apache Tomcat 8.5.21 Apache Tomcat 8.5.22 Apache Tomcat 8.5.23 Apache Tomcat 8.5.24 Apache Tomcat 8.5.25 Apache Tomcat 8.5.26 Apache Tomcat 8.5.27 Apache Tomcat 8.5.28 Apache Tomcat 8.5.29 Apache Tomcat 8.5.30 Apache Tomcat 8.5.31 Apache Tomcat 8.5.32 Apache Tomcat 8.5.33 Apache Tomcat 8.5.34 Apache Tomcat 8.5.35 Apache Tomcat 8.5.36 Apache Tomcat 8.5.37 Apache Tomcat 8.5.38 Apache Tomcat 8.5.39 Apache Tomcat 8.5.40 Apache Tomcat 8.5.41 Apache Tomcat 8.5.42 Apache Tomcat 8.5.43 Apache Tomcat 8.5.44 Apache Tomcat 8.5.45 Apache Tomcat 8.5.46 Apache Tomcat 8.5.47 Apache Tomcat 8.5.48 Apache Tomcat 8.5.49 Apache Tomcat 8.5.50 Apache Tomcat 8.5.51 Apache Tomcat 8.5.52 Apache Tomcat 8.5.53 Apache Tomcat 8.5.54 Apache Tomcat 8.5.55 Apache Tomcat 8.5.56 Apache Tomcat 8.5.57 Apache Tomcat 8.5.58 Apache Tomcat 8.5.59 Apache Tomcat 8.5.60 Apache Tomcat 8.5.61 Apache Tomcat 8.5.62 Apache Tomcat 8.5.63	177
Application	Netapp Netapp Management Services FOR Element Software AND Netapp HCI -	1
OS	Debian Debian Debian Linux 9.0 Debian Debian Linux 10.0 Debian Debian Linux 11.0	3

Common Weakness Enumeration (CWE)

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References