CVE-2021-43980: Apache Tomcat Race Condition Vulnerability

CVE-2021-43980 Overview

A race condition vulnerability exists in Apache Tomcat's simplified implementation of blocking reads and writes that was introduced in Tomcat 10 and back-ported to Tomcat 9.0.47. This long-standing concurrency bug, while extremely hard to trigger, can cause client connections to share an Http11Processor instance, resulting in HTTP responses or partial responses being delivered to the wrong client.

Critical Impact
Sensitive information disclosure where HTTP responses intended for one client may be inadvertently delivered to a different client due to improper thread synchronization in the Http11Processor.

Affected Products

Apache Tomcat 10.1.0-M1 to 10.1.0-M12
Apache Tomcat 10.0.0-M1 to 10.0.18
Apache Tomcat 9.0.0-M1 to 9.0.60
Apache Tomcat 8.5.0 to 8.5.77
Debian Linux 10.0 and 11.0

Discovery Timeline

2022-09-28 - CVE CVE-2021-43980 published to NVD
2025-05-21 - Last updated in NVD database

Technical Details for CVE-2021-43980

Vulnerability Analysis

This vulnerability is classified as CWE-362 (Race Condition), occurring within Apache Tomcat's HTTP connection handling mechanism. The flaw exists in the simplified blocking I/O implementation that was introduced to improve performance in Tomcat 10 and subsequently back-ported to earlier versions.

Under specific high-concurrency conditions, the Http11Processor instance—which handles HTTP/1.1 protocol processing for individual client connections—can be incorrectly shared between multiple client connections. This processor sharing violates the expected one-to-one relationship between processors and connections, leading to response data being sent to unintended recipients.

The race condition is characterized by its difficulty to exploit, requiring precise timing conditions that are unlikely to occur during normal server operation. However, in high-traffic environments or under adversarial conditions designed to maximize thread contention, the probability of triggering this bug increases.

Root Cause

The root cause lies in improper synchronization within the blocking I/O read and write operations introduced in the affected Tomcat versions. When the simplified blocking implementation was added, it inadvertently exposed a pre-existing concurrency bug in the connection processor allocation logic.

Specifically, the Http11Processor recycling mechanism fails to properly ensure thread-safe transitions between connection states, allowing a race condition where one thread may begin using a processor before another thread has fully released it. This results in the processor being associated with multiple connections simultaneously.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker would need to:

Send a high volume of concurrent HTTP requests to the target Tomcat server
Attempt to create timing conditions that trigger the race condition in processor allocation
Monitor responses for data intended for other clients

While the exploitation is non-deterministic and extremely difficult to reliably reproduce, the potential for information disclosure makes this a concern for environments processing sensitive data. The vulnerability requires network access to the Tomcat server but no special privileges or credentials.

Detection Methods for CVE-2021-43980

Indicators of Compromise

Unexpected HTTP response content that doesn't match the client's request context
User reports of receiving data or partial responses belonging to other sessions
Anomalous patterns in access logs showing response size mismatches or unusual status codes
Memory profiling showing unexpected Http11Processor instance sharing across threads

Detection Strategies

Implement response integrity monitoring to detect when response content doesn't correlate with request patterns
Deploy application-layer monitoring to identify sessions receiving unexpected data types or formats
Enable verbose Tomcat connector logging to capture processor allocation and recycling events
Use thread dump analysis during high-load periods to identify concurrent processor access patterns

Monitoring Recommendations

Monitor Tomcat thread pool utilization and connection handling metrics for anomalies
Set up alerts for user-reported data inconsistencies that may indicate cross-connection data leakage
Implement periodic security audits of Tomcat version deployments across the infrastructure
Review application logs for HTTP response correlation errors or session anomalies

How to Mitigate CVE-2021-43980

Immediate Actions Required

Upgrade Apache Tomcat to a patched version: 10.1.0-M13+, 10.0.19+, 9.0.61+, or 8.5.78+
Review and audit any sensitive data that may have been exposed if running affected versions
Implement network segmentation to limit exposure of vulnerable Tomcat instances
Consider temporary traffic reduction measures if immediate patching is not possible

Patch Information

Apache has released security patches addressing this vulnerability. Refer to the Apache Mailing List Thread for official patch information and upgrade guidance.

For Debian-based systems, security updates are available through:

Additional technical discussion is available at the Openwall OSS-Security Discussion.

Workarounds

Reduce the maximum number of concurrent connections (maxConnections) to lower the probability of triggering the race condition
Configure connection timeouts more aggressively to reduce window of exposure
Implement a reverse proxy with session affinity to reduce concurrent connection load per Tomcat instance
Monitor for and immediately investigate any user reports of receiving incorrect response data

bash

# Configuration example - Reduce concurrent connections in server.xml
# Modify the Connector element to limit maximum connections:
# <Connector port="8080" protocol="HTTP/1.1"
#            maxConnections="500"
#            connectionTimeout="20000"
#            redirectPort="8443" />

# Verify current Tomcat version
catalina.sh version

# Check for security updates on Debian systems
apt-get update && apt-cache policy tomcat9