CVE-2021-41079
📋 TL;DR
This vulnerability in Apache Tomcat allows denial of service attacks when using specific TLS configurations. Attackers can send specially crafted TLS packets to trigger an infinite loop, causing Tomcat to become unresponsive. Affected systems include Tomcat 8.5.0-8.5.63, 9.0.0-M1-9.0.43, and 10.0.0-M1-10.0.2 configured with NIO+OpenSSL or NIO2+OpenSSL.
💻 Affected Systems
- Apache Tomcat
📦 What is this software?
Management Services For Element Software And Netapp Hci by Netapp
View all CVEs affecting Management Services For Element Software And Netapp Hci →
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service causing Tomcat to become completely unresponsive, requiring manual restart and potentially disrupting critical web applications.
Likely Case
Service disruption and downtime for web applications hosted on vulnerable Tomcat instances, leading to business impact and potential revenue loss.
If Mitigated
Minimal impact if systems are patched or using unaffected TLS configurations, with normal service availability maintained.
🎯 Exploit Status
Exploitation requires network access to Tomcat's TLS port and knowledge of the specific TLS configuration in use.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.5.64, 9.0.44, 10.0.3
Vendor Advisory: https://lists.apache.org/thread.html/rccdef0349fdf4fb73a4e4403095446d7fe6264e0a58e2df5c6799434%40%3Cannounce.tomcat.apache.org%3E
Restart Required: Yes
Instructions:
1. Download patched Tomcat version from Apache website. 2. Stop Tomcat service. 3. Backup current installation. 4. Replace with patched version. 5. Restart Tomcat service.
🔧 Temporary Workarounds
Change TLS Connector Configuration
allSwitch from NIO+OpenSSL or NIO2+OpenSSL to a different connector type like APR/native or JSSE.
Edit server.xml and change connector protocol attribute from 'org.apache.coyote.http11.Http11NioProtocol' or similar to 'org.apache.coyote.http11.Http11AprProtocol' or use default JSSE
Network Segmentation
linuxRestrict access to Tomcat TLS ports to trusted networks only.
iptables -A INPUT -p tcp --dport 8443 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j DROP
🧯 If You Can't Patch
- Implement network-based IPS/IDS rules to detect and block malformed TLS packets
- Use load balancers or WAFs to filter traffic before reaching Tomcat instances
🔍 How to Verify
Check if Vulnerable:
Check Tomcat version and connector configuration in server.xml for NIO+OpenSSL or NIO2+OpenSSL usageCheck Version:
java -cp catalina.jar org.apache.catalina.util.ServerInfoVerify Fix Applied:
Verify Tomcat version is 8.5.64+, 9.0.44+, or 10.0.3+ and test TLS connectivity remains functional📡 Detection & Monitoring
Log Indicators:
- High CPU usage spikes
- Thread pool exhaustion messages
- Connection timeouts in access logs
Network Indicators:
- Unusual TLS handshake patterns
- Repeated malformed packet attempts to port 8443/443
SIEM Query:
source="tomcat" AND ("CPU" OR "thread" OR "timeout") AND severity>=WARNING🔗 References
- https://lists.apache.org/thread.html/r6b6b674e3f168dd010e67dbe6848b866e2acf26371452fdae313b98a%40%3Cusers.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rb4de81ac647043541a32881099aa6eb5a23f1b7fd116f713f8ab9dbe%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rccdef0349fdf4fb73a4e4403095446d7fe6264e0a58e2df5c6799434%40%3Cannounce.tomcat.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/09/msg00012.html
- https://security.netapp.com/advisory/ntap-20211008-0005/
- https://www.debian.org/security/2021/dsa-4986
- https://lists.apache.org/thread.html/r6b6b674e3f168dd010e67dbe6848b866e2acf26371452fdae313b98a%40%3Cusers.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rb4de81ac647043541a32881099aa6eb5a23f1b7fd116f713f8ab9dbe%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rccdef0349fdf4fb73a4e4403095446d7fe6264e0a58e2df5c6799434%40%3Cannounce.tomcat.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/09/msg00012.html
- https://security.netapp.com/advisory/ntap-20211008-0005/
- https://www.debian.org/security/2021/dsa-4986
