Search for vulnerabilities
Vulnerability details: VCID-urnb-7r7w-aaae
Vulnerability ID VCID-urnb-7r7w-aaae
Aliases CVE-2021-41079
GHSA-59g9-7gfx-c72p
Summary Infinite loop in Tomcat due to parsing error
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
CWE-20 Improper Input Validation
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-400 Uncontrolled Resource Consumption
System Score Found at
rhas Important https://access.redhat.com/errata/RHSA-2021:3741
rhas Important https://access.redhat.com/errata/RHSA-2021:3743
rhas Important https://access.redhat.com/errata/RHSA-2022:1179
rhas Important https://access.redhat.com/errata/RHSA-2022:5532
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-41079.json
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00201 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00522 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00522 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00522 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00522 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00522 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00522 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00522 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00522 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00522 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00522 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00522 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00545 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00545 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00545 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
epss 0.00545 https://api.first.org/data/v1/epss?cve=CVE-2021-41079
rhbs high https://bugzilla.redhat.com/show_bug.cgi?id=2004820
apache_tomcat Important https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41079
cvssv3.1 5.9 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-59g9-7gfx-c72p
cvssv3.1 7.5 https://github.com/apache/tomcat
generic_textual HIGH https://github.com/apache/tomcat
cvssv3.1 7.5 https://github.com/apache/tomcat/commit/34115fb3c83f6cd97772232316a492a4cc5729e0
generic_textual HIGH https://github.com/apache/tomcat/commit/34115fb3c83f6cd97772232316a492a4cc5729e0
cvssv3.1 7.5 https://lists.apache.org/thread.html/r6b6b674e3f168dd010e67dbe6848b866e2acf26371452fdae313b98a@%3Cusers.tomcat.apache.org%3E
generic_textual HIGH https://lists.apache.org/thread.html/r6b6b674e3f168dd010e67dbe6848b866e2acf26371452fdae313b98a@%3Cusers.tomcat.apache.org%3E
cvssv3.1 7.5 https://lists.apache.org/thread.html/rb4de81ac647043541a32881099aa6eb5a23f1b7fd116f713f8ab9dbe@%3Cdev.tomcat.apache.org%3E
generic_textual HIGH https://lists.apache.org/thread.html/rb4de81ac647043541a32881099aa6eb5a23f1b7fd116f713f8ab9dbe@%3Cdev.tomcat.apache.org%3E
cvssv3.1 7.5 https://lists.apache.org/thread.html/rccdef0349fdf4fb73a4e4403095446d7fe6264e0a58e2df5c6799434%40%3Cannounce.tomcat.apache.org%3E
generic_textual HIGH https://lists.apache.org/thread.html/rccdef0349fdf4fb73a4e4403095446d7fe6264e0a58e2df5c6799434%40%3Cannounce.tomcat.apache.org%3E
cvssv3.1 7.5 https://lists.debian.org/debian-lts-announce/2021/09/msg00012.html
generic_textual HIGH https://lists.debian.org/debian-lts-announce/2021/09/msg00012.html
cvssv2 4.3 https://nvd.nist.gov/vuln/detail/CVE-2021-41079
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2021-41079
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2021-41079
cvssv3.1 7.5 https://security.netapp.com/advisory/ntap-20211008-0005
generic_textual HIGH https://security.netapp.com/advisory/ntap-20211008-0005
cvssv3.1 7.5 https://www.debian.org/security/2021/dsa-4986
generic_textual HIGH https://www.debian.org/security/2021/dsa-4986
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-41079.json
https://api.first.org/data/v1/epss?cve=CVE-2021-41079
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/apache/tomcat
https://github.com/apache/tomcat/commit/34115fb3c83f6cd97772232316a492a4cc5729e0
https://github.com/apache/tomcat/commit/b90d4fc1ff44f30e4b3aba622ba6677e3f003822
https://github.com/apache/tomcat/commit/d4b340fa8feaf55831f9a59350578f7b6ca048b8
https://lists.apache.org/thread.html/r6b6b674e3f168dd010e67dbe6848b866e2acf26371452fdae313b98a@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r6b6b674e3f168dd010e67dbe6848b866e2acf26371452fdae313b98a%40%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rb4de81ac647043541a32881099aa6eb5a23f1b7fd116f713f8ab9dbe@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rb4de81ac647043541a32881099aa6eb5a23f1b7fd116f713f8ab9dbe%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rccdef0349fdf4fb73a4e4403095446d7fe6264e0a58e2df5c6799434%40%3Cannounce.tomcat.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/09/msg00012.html
https://security.netapp.com/advisory/ntap-20211008-0005
https://security.netapp.com/advisory/ntap-20211008-0005/
https://www.debian.org/security/2021/dsa-4986
2004820 https://bugzilla.redhat.com/show_bug.cgi?id=2004820
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:management_services_for_element_software_and_netapp_hci:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:management_services_for_element_software_and_netapp_hci:-:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
CVE-2021-41079 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41079
CVE-2021-41079 https://nvd.nist.gov/vuln/detail/CVE-2021-41079
GHSA-59g9-7gfx-c72p https://github.com/advisories/GHSA-59g9-7gfx-c72p
RHSA-2021:3741 https://access.redhat.com/errata/RHSA-2021:3741
RHSA-2021:3743 https://access.redhat.com/errata/RHSA-2021:3743
RHSA-2022:1179 https://access.redhat.com/errata/RHSA-2022:1179
RHSA-2022:5532 https://access.redhat.com/errata/RHSA-2022:5532
USN-5360-1 https://usn.ubuntu.com/5360-1/
USN-6943-1 https://usn.ubuntu.com/6943-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-41079.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/apache/tomcat
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/apache/tomcat/commit/34115fb3c83f6cd97772232316a492a4cc5729e0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.apache.org/thread.html/r6b6b674e3f168dd010e67dbe6848b866e2acf26371452fdae313b98a@%3Cusers.tomcat.apache.org%3E
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.apache.org/thread.html/rb4de81ac647043541a32881099aa6eb5a23f1b7fd116f713f8ab9dbe@%3Cdev.tomcat.apache.org%3E
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.apache.org/thread.html/rccdef0349fdf4fb73a4e4403095446d7fe6264e0a58e2df5c6799434%40%3Cannounce.tomcat.apache.org%3E
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.debian.org/debian-lts-announce/2021/09/msg00012.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2021-41079
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-41079
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-41079
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://security.netapp.com/advisory/ntap-20211008-0005
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://www.debian.org/security/2021/dsa-4986
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.0311
EPSS Score 0.00018
Published At May 1, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.