Disclosure summary
A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65.
Source-reported weakness categories
CWE-116
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2021-30640
Open original source · Updated Oct 08, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| apache | tomcat | * {"versionStartIncluding":"10.0.0","versionEndExcluding":"10.0.6"} |
| oracle | communications_cloud_native_core_policy | 1.14.0 |
| oracle | communications_diameter_signaling_router | * {"versionStartIncluding":"8.0.0","versionEndIncluding":"8.5.0"} |
| oracle | communications_pricing_design_center | 12.0.0.3.0 |
| oracle | hospitality_cruise_shipboard_property_management_system | 20.1.0 |
| oracle | tekelec_platform_distribution | * {"versionStartIncluding":"7.4.0","versionEndIncluding":"7.7.1"} |
| debian | debian_linux | 9.0 |
| debian | debian_linux | 10.0 |
| debian | debian_linux | 11.0 |
Original records & references
- NIST NVD record
- CVE Program record
- lists.apache.org — Mailing List, Vendor Advisory
- lists.debian.org — Mailing List, Third Party Advisory
- security.gentoo.org — Third Party Advisory
- security.netapp.com — Third Party Advisory
- www.debian.org — Third Party Advisory
- www.debian.org — Third Party Advisory
- www.oracle.com — Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
- lists.apache.org — Mailing List, Vendor Advisory
- lists.debian.org — Mailing List, Third Party Advisory
- security.gentoo.org — Third Party Advisory
- security.netapp.com — Third Party Advisory
- www.debian.org — Third Party Advisory
- www.debian.org — Third Party Advisory
- www.oracle.com — Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
PUBLISHED 2021-07-12T11:15:08-04:00
MODIFIED 2026-10-08T17:17:35-04:00
INGESTED 2026-10-10T20:50:20-04:00