Apache Tomcat 9.0.0.M1 < 9.0.44 multiple vulnerabilities

This Tenable plugin (194473) bundles two CVEs fixed in Apache Tomcat 9.0.44, released March 2021 — over five years ago. CVE-2021-41079 (CVSS 7.5 HIGH) is a denial-of-service via infinite loop triggered by a malformed TLS packet, but *only* when Tomcat is configured with NIO+OpenSSL or NIO2+OpenSSL connectors — a non-default configuration most deployments never enable. CVE-2024-21733 (CVSS 5.3 MEDIUM) is an information-disclosure flaw where an incomplete POST request causes Tomcat's error page to leak body data from a *different user's prior request*, potentially exposing credentials or session tokens.

Tenable rates the plugin MEDIUM, which is reasonable. The NVD HIGH score for CVE-2021-41079 overstates real-world risk because it ignores the OpenSSL connector prerequisite that eliminates the vast majority of Tomcat deployments. CVE-2024-21733 is the more broadly applicable issue — it requires no authentication, works over the network, and has a public PoC — but its impact ceiling is partial confidentiality loss (leaked fragments), not code execution or persistent compromise. The MEDIUM rating holds.

Why this verdict

• Non-default prerequisite narrows CVE-2021-41079 to near-irrelevance. The DoS requires NIO+OpenSSL or NIO2+OpenSSL connector config AND direct TLS termination at Tomcat. Enterprise deployments overwhelmingly offload TLS at load balancers or reverse proxies, making this condition rare.
• CVE-2024-21733 impact ceiling is partial confidentiality. The info leak is probabilistic — the attacker cannot target specific users or guarantee useful data in the leaked buffer fragments. No path to code execution, privilege escalation, or lateral movement exists from this flaw alone.
• Role multiplier: Tomcat occupies roles ranging from dev sandbox (low-value) to production application tier hosting business-critical apps (typical) to identity-adjacent services like SSO portals or admin consoles (high-value). Even in high-value roles, neither CVE enables RCE, domain compromise, or supply-chain pivot. The DoS is recoverable; the info leak is partial. The blast radius is host-level availability or partial single-request confidentiality — not fleet-scale. No floor elevation is warranted.
• Age and adoption of fix. The patch (9.0.44) shipped in March 2021 — over 5 years ago. Any system still vulnerable has likely been scanned and reported multiple times. The residual vulnerable population is small and shrinking.
• No KEV, no campaigns, no weaponization. Despite public PoC for CVE-2024-21733 and a 96th-percentile EPSS, there are no documented threat campaigns, no ransomware adoption, and no KEV listing.

Why not higher?

Neither CVE enables remote code execution, privilege escalation, or any write-side impact. CVE-2021-41079 is availability-only and gated behind an uncommon configuration. CVE-2024-21733 leaks partial request data probabilistically — there is no reliable path from this leak to account takeover or lateral movement. Absent RCE or KEV listing, HIGH is not justified.

Why not lower?

CVE-2024-21733 is unauthenticated, network-reachable, requires no user interaction, and has a working public PoC with a 96th-percentile EPSS score. The leaked data *can* include credentials or tokens in POST bodies. Dismissing this as LOW would understate the real confidentiality risk for internet-facing Tomcat instances that have not patched in over five years.

1. Deploy a reverse proxy or WAF in front of Tomcat — A reverse proxy (NGINX, HAProxy, F5) that terminates TLS eliminates CVE-2021-41079 entirely and can filter malformed POST requests that trigger CVE-2024-21733. If not already in place, deploy within the 365-day noisgate remediation window.
2. Disable NIO+OpenSSL connector if configured — Switch server.xml connector protocol to default NIO with JSSE (Http11NioProtocol without tc-native) to eliminate CVE-2021-41079. This is a configuration change, not a code change — low risk to deploy.
3. Upgrade to Tomcat 9.0.44 or later — The definitive fix. Given the MEDIUM verdict, target the noisgate remediation SLA of 365 days — though given these patches are 5+ years old, there is no reason to delay if a maintenance window is available.
4. Enable custom error pages — Configure <error-page> directives in web.xml to suppress default Tomcat error responses, reducing the data exposed by CVE-2024-21733's error-message leak.

Run this script on the Tomcat host (or any host with curl access to the target). Invoke as: bash check_tomcat_194473.sh https://target:8443. No special privileges required — it only issues HTTP requests and parses the response.

#!/usr/bin/env bash
# check_tomcat_194473.sh — Detect Apache Tomcat < 9.0.44 (Tenable 194473)
# Usage: bash check_tomcat_194473.sh <BASE_URL>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

URL="${1:-}"
if [ -z "$URL" ]; then
  echo "Usage: $0 <BASE_URL>" >&2
  exit 2
fi

# Attempt to extract Tomcat version from a 404 error page
RESP=$(curl -sk -o - -w '\n%{http_code}' "${URL}/noisgate-version-check-$(date +%s)" 2>/dev/null || true)

if echo "$RESP" | grep -qiE 'Apache Tomcat/[0-9]'; then
  VERSION=$(echo "$RESP" | grep -oiE 'Apache Tomcat/[0-9]+\.[0-9]+\.[0-9]+' | head -1 | cut -d'/' -f2)
  if [ -z "$VERSION" ]; then
    echo "UNKNOWN — Could not parse Tomcat version from response."
    exit 2
  fi

  MAJOR=$(echo "$VERSION" | cut -d. -f1)
  MINOR=$(echo "$VERSION" | cut -d. -f2)
  PATCH=$(echo "$VERSION" | cut -d. -f3)

  echo "Detected: Apache Tomcat/$VERSION"

  if [ "$MAJOR" -eq 9 ] && [ "$MINOR" -eq 0 ] && [ "$PATCH" -lt 44 ]; then
    echo "VULNERABLE — Tomcat $VERSION is < 9.0.44 (affected by CVE-2021-41079, CVE-2024-21733)"
    exit 1
  elif [ "$MAJOR" -eq 9 ] && [ "$MINOR" -eq 0 ] && [ "$PATCH" -ge 44 ]; then
    echo "PATCHED — Tomcat $VERSION is >= 9.0.44"
    exit 0
  elif [ "$MAJOR" -lt 9 ]; then
    echo "VULNERABLE — Tomcat $VERSION is in an older major branch (check 8.5.x separately)"
    exit 1
  else
    echo "PATCHED — Tomcat $VERSION is a newer branch"
    exit 0
  fi
else
  # Fallback: check via manager or version endpoint
  echo "UNKNOWN — Tomcat version not disclosed in error page (version hiding or WAF in front)."
  echo "Verify manually: check CATALINA_HOME/lib/catalina.jar META-INF/MANIFEST.MF or run 'catalina.sh version'"
  exit 2
fi

Sources

1. Tenable Plugin 194473
2. Apache Tomcat 9 Security Advisories
3. NVD — CVE-2021-41079
4. NVD — CVE-2024-21733
5. CVE-2024-21733 PoC (LtmThink)
6. HackerOne Report #2327341
7. FIRST EPSS API
8. Recorded Future — Tomcat Exposure Analysis