CVE-2021-30639 — tomcat
HIGHCVE-2021-30639 is a high-severity (CVSS 7.5) CWE-755 vulnerability in org.apache.tomcat:tomcat. A fix is available for org.apache.tomcat:tomcat — see the affected versions and patch details below.
Improper Handling of Exceptional Conditions in Apache Tomcat
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2021-30639 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 385,987 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
org.apache.tomcat:tomcat☕org.apache.tomcat:tomcat☕org.apache.tomcat:tomcatReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS. Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | org.apache.tomcat:tomcat | ≥ 10.0.3&&< 10.0.5 | 10.0.5org.apache.tomcat:tomcat:10.0.5 |
| ☕Maven | org.apache.tomcat:tomcat | ≥ 9.0.0&&< 9.0.45 | 9.0.45org.apache.tomcat:tomcat:9.0.45 |
| ☕Maven | org.apache.tomcat:tomcat | all versions | 8.5.65org.apache.tomcat:tomcat:8.5.65 |
Affected Products
tomcatapacheepolicy orchestratormcafeebig data spatial and graphoracleDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.apache.tomcat:tomcat, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update org.apache.tomcat:tomcat to 10.0.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2021-30639 is resolved across your whole dependency graph.
Workarounds
Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.
Frequently Asked Questions
Is CVE-2021-30639 in your dependencies?
Find it across Maven, including transitive dependencies.