BIT-tomcat-2021-41079

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/tomcat/BIT-tomcat-2021-41079.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-tomcat-2021-41079
Aliases
Published
2024-03-06T11:09:56.377Z
Modified
2026-03-20T10:00:33.400768Z
Summary
Apache Tomcat DoS with unexpected TLS packet
Details

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0 to 9.0.43 and 10.0.0 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.

Database specific 
{
    "cpes": [
        "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*"
    ],
    "severity": "High"
}
References

Affected packages

Bitnami / tomcat

Package

Name
tomcat
Purl
pkg:bitnami/tomcat

Severity

  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
8.5.0
Fixed
8.5.64
Introduced
9.0.0
Fixed
9.0.44
Introduced
10.0.0
Fixed
10.0.3

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/tomcat/BIT-tomcat-2021-41079.json"