CVE-2021-43980

Apache Tomcat: Information disclosure

The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.

We have discovered 854 live websites that are affected by CVE-2021-43980.

Run a Free Instant Scan



Affected Software

Product  Apache Tomcat
Category Web Servers
Vulnerable Domains854 live websites (13% of Apache Tomcat install base)
Vulnerable Versions
  • from 8.5 through 8.5.78
Vulnerable Versions Count56 versions ( 15% of all versions)


Common Weakness Enumeration

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')



Details

  • Published - Sep 28, 2022
  • Updated - May 21, 2025

Credits

  • Thanks to Adam Thomas, Richard Hernandez and Ryan Schmitt for discovering the issue and working with the Tomcat security team to identify the root cause and appropriate fix.

Website Distribution by Country

Number of websites using CVE-2021-43980
United States230 websites


China338 websites
Italy26 websites
Singapore22 websites
Germany21 websites
France14 websites
Korea, South14 websites
India10 websites
Brazil9 websites

Website Distribution by TLD

Number of websites using CVE-2021-43980
.com427 websites
.cn78 websites
.org30 websites
.com.cn28 websites
.net26 websites
.it25 websites
.edu14 websites
.com.br11 websites
.de9 websites
.fr8 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2021-43980

Top websites that are affected by CVE-2021-43980. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
******.******.org United States***,***
***********.***.cn China***,***
*******.***.es Netherlands***,***
******.com United States***,***
*********.******.cn China***,***
*********.******.cn China***,***
************.*****.com China***,***
**************.com Turkey***,***
***.*******.com United States***,***
*******.******.cn China***,***
See full domain list

FAQ

CVE-2021-43980 is Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in Apache Tomcat
A total of 854 websites have been identified as vulnerable to CVE-2021-43980, based on global website indexing conducted by WebTechSurvey.
The Apache Tomcat is affected by the CVE-2021-43980 vulnerability.
Apache Tomcat versions up to 8.5.78 are vulnerable to CVE-2021-43980.
CVE-2021-43980 is resolved in version 8.5.78 of Apache Tomcat.