CVE-2021-41079

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.

• CWE-20
• CWE-835

• https://lists.apache.org/thread.html/r6b6b674e3f168dd010e67dbe6848b866e2acf26371452fdae313b98a%40%3Cusers.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/rb4de81ac647043541a32881099aa6eb5a23f1b7fd116f713f8ab9dbe%40%3Cdev.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/rccdef0349fdf4fb73a4e4403095446d7fe6264e0a58e2df5c6799434%40%3Cannounce.tomcat.apache.org%3EMailing List, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2021/09/msg00012.htmlMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20211008-0005/Third Party Advisory
• https://www.debian.org/security/2021/dsa-4986Third Party Advisory
• https://lists.apache.org/thread.html/r6b6b674e3f168dd010e67dbe6848b866e2acf26371452fdae313b98a%40%3Cusers.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/rb4de81ac647043541a32881099aa6eb5a23f1b7fd116f713f8ab9dbe%40%3Cdev.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/rccdef0349fdf4fb73a4e4403095446d7fe6264e0a58e2df5c6799434%40%3Cannounce.tomcat.apache.org%3EMailing List, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2021/09/msg00012.htmlMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20211008-0005/Third Party Advisory
• https://www.debian.org/security/2021/dsa-4986Third Party Advisory

Published

Sep 16, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41073loop_rw_iter in fs/io_uring.c in the Linux kernel 5.10 throu…7.8
• CVE-2021-41074A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 a…5.4
• CVE-2021-41075The NetFlow Analyzer in Zoho ManageEngine OpManger before 12…9.8
• CVE-2021-41076Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-41077The activation process in Travis CI, for certain 2021-09-03 …7.5
• CVE-2021-41078Nameko through 2.13.0 can be tricked into performing arbitra…7.8
• CVE-2021-4108snipe-it is vulnerable to Improper Neutralization of Input D…6.1
• CVE-2021-41080Zoho ManageEngine Network Configuration Manager before 125…9.8
• CVE-2021-41081Zoho ManageEngine Network Configuration Manager before 125…9.8
• CVE-2021-41082Discourse is a platform for community discussion. In affecte…7.5
• CVE-2021-41083Dada Mail is a web-based e-mail list management system. In a…8.8
• CVE-2021-41084http4s is an open source scala interface for HTTP. In affect…4.7