---

CVE-2021-42340 - log back

CVE-2021-42340 edited at 14 Oct 2021 21:16:01
Severity	- Unknown + High
Remote	- Unknown + Remote
Type	- Unknown + Denial of service
Description	+ A security issue has been found in Apache Tomcat before versions 10.0.12, 9.0.54 and 8.5.72. The fix for bug 63362 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the WebSocket connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.
References	+ https://lists.apache.org/thread.html/r83a35be60f06aca2065f188ee542b9099695d57ced2e70e0885f905c%40%3Cannounce.tomcat.apache.org%3E + https://bz.apache.org/bugzilla/show_bug.cgi?id=63362
Notes

CVE-2021-42340 created at 14 Oct 2021 21:12:46