CVE-2021-41079: Apache Tomcat DoS with unexpected TLS packet
Vulnerability summary
CVE-2021-41079 is a high (CVSS 7.5) Improper Input Validation vulnerability in apache software foundation apache tomcat. EPSS estimates a 7.18% chance of exploitation in the next 30 days, higher than 94.3% of scored vulnerabilities.
Severe, CVSS 7.5 (NVD); no exploitation reported by the 5 checked sources; EPSS 7% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 12 · Related 11Timeline
- 16-09-2021PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
7.18%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
No change 0.00 pp
From 7.18% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-835Loop with Unreachable Exit ConditionThe product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat12 products
- jws5-tomcat< 0:9.0.43-13.redhat_00013.1.el7jws | < 0:9.0.43-13.redhat_00013.1.el8jws
- jws5-tomcat-admin-webapps< 0:9.0.43-13.redhat_00013.1.el7jws | < 0:9.0.43-13.redhat_00013.1.el8jws
- jws5-tomcat-docs-webapp< 0:9.0.43-13.redhat_00013.1.el7jws | < 0:9.0.43-13.redhat_00013.1.el8jws
- jws5-tomcat-el-3.0-api< 0:9.0.43-13.redhat_00013.1.el7jws | < 0:9.0.43-13.redhat_00013.1.el8jws
- jws5-tomcat-java-jdk11< 0:9.0.43-13.redhat_00013.1.el7jws
Debian3 products
- tomcat8< 8.5.54-0+deb9u8
- tomcat9< 9.0.53-1 | < 9.0.31-1~deb10u6 | < 9.0.43-2~deb11u2
- debian_linuxEOL9.0 | 10.0 | 11.0
Ubuntu2 products
- tomcat8< 8.5.39-1ubuntu1~18.04.3+esm2
- tomcat9< 9.0.16-3ubuntu0.18.04.2 | < 9.0.31-1ubuntu0.2
Apache1 product
- tomcat≥ 8.5.0, < 8.5.64 | ≥ 9.0.0, < 9.0.44 | ≥ 10.0.0, ≤ 10.0.2
Apache software foundation1 product
- apache tomcatApache Tomcat 8.5 8.5.0 to 8.5.63 | Apache Tomcat 9 9.0.0-M1 to 9.0.43 | Apache Tomcat 10 10.0.0-M1 to 10.0.2
Netapp1 product
Org.apache.tomcat1 product
- tomcat≥ 10.0.0, < 10.0.4 | ≥ 9.0.0, < 9.0.44 | ≥ 8.5.0, < 8.5.64
7 vendors · 21 products
References
27 links
lists.debian.org/debian-lts-announce/2021/09/msg00012.htmlMailing ListX Refsource MLISTWEBThird Party Advisory
Show all 27 references
- github.com/apache/tomcatPACKAGE