CVE-2021-30639

A flaw was found in Apache Tomcat. This flaw allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This means that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users can trigger non-blocking I/O errors (ex. by dropping a connection), creating the possibility of triggering a denial of service. Applications that do not use non-blocking I/O are not exposed to this vulnerability. The highest threat from this vulnerability is to system availability.

Red Hat OpenStack Platform's OpenDaylight will not be updated for this flaw because it was deprecated as of OpenStack Platform 14 and is only receiving security fixes for Critical flaws.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.