CVE-2021-43980: Apache Tomcat Race Condition vulnerability
3.7
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.37829%
CWE
Published
9/29/2022
Updated
3/11/2024
KEV Status
No
Technology
Java
JavaTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.tomcat:tomcat | maven | >= 8.5.0, < 8.5.78 | 8.5.78 |
| org.apache.tomcat:tomcat | maven | >= 9.0.0-M1, < 9.0.62 | 9.0.62 |
| org.apache.tomcat:tomcat | maven | >= 10.0.0-M1, < 10.0.20 | 10.0.20 |
| org.apache.tomcat:tomcat | maven | >= 10.1.0-M1, < 10.1.0-M14 | 10.1.0-M14 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stemmed from improper synchronization around Http11Processor instance management. The commit diff shows critical changes: 1) Replacing getCurrentProcessor() with takeCurrentProcessor() (atomic get-and-clear), 2) Converting currentProcessor to AtomicReference. The original functions lacked atomic operations, allowing race conditions where multiple client connections could share a processor instance. The vulnerable functions directly handled processor association/dissociation without thread-safe mechanisms, leading to response mix-ups between clients.