| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.tomcat:tomcat | ≥ 10.0.0-M1, < 10.0.12≥ 10.1.0-M1, < 10.1.0-M6≥ 8.5.60, < 8.5.72≥ 9.0.40, < 9.0.54 | 10.0.1210.1.0-M68.5.729.0.54 |
| tomcat | = 10.0.0= 10.1.0≥ 10.0.1, < 10.0.12≥ 8.5.60, < 8.5.72≥ 9.0.40, < 9.0.54 | 10.0.128.5.729.0.54 |
| agile engineering data management | = 6.2.1.0 | |
| big data spatial and graph | < 23.1 | 23.1 |
| communications diameter signaling router | ≥ 8.0.0.0, ≤ 8.5.0.2 | |
| hospitality cruise shipboard property management system | = 20.1.0 | |
| managed file transfer | = 12.2.1.3.0= 12.2.1.4.0 | |
| middleware common libraries and tools | = 12.2.1.4.0 | |
| payment interface | = 19.1= 20.3 | |
| retail customer insights | = 15.0.2= 16.0.2 | |
| retail data extractor for merchandising | = 15.0.2= 16.0.2 | |
| retail eftlink | = 21.0.0 | |
| retail financial integration | = 16.0.1= 19.0.0 | |
| retail store inventory management | = 14.0.4.13= 14.1.3.14= 14.1.3.5= 15.0.3.3= 15.0.3.8= 16.0.3.7 | |
| sd-wan edge | = 9.0= 9.1 |
The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free