CVE-2023-24998
published 2023-02-20CVE-2023-24998: Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS…
PriorityP359high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
46.84%
98.7th percentile
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.
Note that, like all of the file upload limits, the
new configuration option (FileUploadBase#setFileCountMax) is not
enabled by default and must be explicitly configured.
Affected
35 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | commons_fileupload | — | — |
| apache | commons_fileupload | >= 1.0 < 1.5 | 1.5 |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | 10.1.5 – 10.1.7 | — |
| apache | tomcat | 8.5.85 – 8.5.87 | — |
| apache | tomcat | 9.0.71 – 9.0.73 | — |
| apache_software_foundation | apache_tomcat | 10.1.5 – 10.1.7 | — |
| apache_software_foundation | apache_tomcat | 11.0.0-M2 – 11.0.0-M4 | — |
| apache_software_foundation | apache_tomcat | 8.5.85 – 8.5.87 | — |
| apache_software_foundation | apache_tomcat | 9.0.71 – 9.0.73 | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | libcommons-fileupload-java | < libcommons-fileupload-java 1.4-2 (bookworm) | libcommons-fileupload-java 1.4-2 (bookworm) |
| debian | tomcat10 | < libcommons-fileupload-java 1.4-2 (bookworm) | libcommons-fileupload-java 1.4-2 (bookworm) |
| debian | tomcat10 | < tomcat10 10.1.6-1+deb12u1 (bookworm) | tomcat10 10.1.6-1+deb12u1 (bookworm) |
| debian | tomcat9 | < libcommons-fileupload-java 1.4-2 (bookworm) | libcommons-fileupload-java 1.4-2 (bookworm) |
| debian | tomcat9 | < tomcat10 10.1.6-1+deb12u1 (bookworm) | tomcat10 10.1.6-1+deb12u1 (bookworm) |
| jenkins | due_to_how_jenkins_community_update_sites_serve_plugin | — | — |
| jenkins | jenkins | < 2.375.4 | 2.375.4 |
| jenkins | jenkins | < 2.394 | 2.394 |
| jenkins | jenkins_community_update_sites_no_longer_publish_plugin | — | — |
| jenkins | jenkins_core | — | — |
| jenkins | jenkins_core_version_on_plugin | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
ghsa7.5HIGH
osv7.5HIGH
vendor_apache7.5HIGH
vendor_debian7.5HIGH
vendor_oracle7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
DoS vulnerabilities persist in ESAPI file uploads despite remediation of CVE-2023-24998
osv·2023-10-27·CVSS 7.5
CVE-2023-24998 [HIGH] DoS vulnerabilities persist in ESAPI file uploads despite remediation of CVE-2023-24998
DoS vulnerabilities persist in ESAPI file uploads despite remediation of CVE-2023-24998
### Impact
ESAPI 2.5.2.0 and later addressed the DoS vulnerability described in CVE-2023-24998, which Apache Commons FileUpload 1.5 attempted to remediate. But while writing up a new security bulletin regarding the impact on the affected ESAPI `HTTPUtilities.getFileUploads` methods (or more specifically those methods in the `DefaultHTTPUtilities` implementation class), I realized that a DoS vulnerability still persists in ESAPI and for that matter in Apache Commons FileUpload as well.
### Related to
CVE-2023-24998
### Patches
ESAPI 2.5.2.0 or later.
### Workarounds
- See the 'Solutions' section of Security Bulletin 11, in the References section. If you are not using ESAPI file uploads, see also the
GHSA
DoS vulnerabilities persist in ESAPI file uploads despite remediation of CVE-2023-24998
ghsa·2023-10-27·CVSS 7.5
CVE-2023-24998 [HIGH] DoS vulnerabilities persist in ESAPI file uploads despite remediation of CVE-2023-24998
DoS vulnerabilities persist in ESAPI file uploads despite remediation of CVE-2023-24998
### Impact
ESAPI 2.5.2.0 and later addressed the DoS vulnerability described in CVE-2023-24998, which Apache Commons FileUpload 1.5 attempted to remediate. But while writing up a new security bulletin regarding the impact on the affected ESAPI `HTTPUtilities.getFileUploads` methods (or more specifically those methods in the `DefaultHTTPUtilities` implementation class), I realized that a DoS vulnerability still persists in ESAPI and for that matter in Apache Commons FileUpload as well.
### Related to
CVE-2023-24998
### Patches
ESAPI 2.5.2.0 or later.
### Workarounds
- See the 'Solutions' section of Security Bulletin 11, in the References section. If you are not using ESAPI file uploads, see also the
OSV
Apache Tomcat - Fix for CVE-2023-24998 was incomplete
osv·2023-07-06·CVSS 7.5
CVE-2023-28709 [HIGH] Apache Tomcat - Fix for CVE-2023-24998 was incomplete
Apache Tomcat - Fix for CVE-2023-24998 was incomplete
The fix for CVE-2023-24998 was incomplete. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.
GHSA
Apache Tomcat - Fix for CVE-2023-24998 was incomplete
ghsa·2023-07-06·CVSS 7.5
CVE-2023-28709 [HIGH] CWE-193 Apache Tomcat - Fix for CVE-2023-24998 was incomplete
Apache Tomcat - Fix for CVE-2023-24998 was incomplete
The fix for CVE-2023-24998 was incomplete. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.
OSV
CVE-2023-28709: The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11
osv·2023-05-22·CVSS 7.5
CVE-2023-28709 [HIGH] CVE-2023-28709: The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11
The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.
OSV
Denial of service in Jenkins Core
osv·2023-03-10·CVSS 7.5
CVE-2023-27900 [HIGH] Denial of service in Jenkins Core
Denial of service in Jenkins Core
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier, and prior to LTS 2.387.1 is affected by the Apache Commons FileUpload library’s vulnerability CVE-2023-24998. This library is used to process uploaded files via the Stapler web framework (usually through StaplerRequest#getFile) and MultipartFormDataParser in Jenkins.
This allows attackers to cause a denial of service (DoS) by sending crafted requests to HTTP endpoints processing file uploads.
Jenkins 2.394, LTS 2.375.4, and LTS 2.387.1 limits the number of request parts to be processed to 1000. Specific endpoints receiving only simple form submissions have a lower limit.
OSV
Denial of service in Jenkins Core
osv·2023-03-10·CVSS 7.5
CVE-2023-27901 [HIGH] Denial of service in Jenkins Core
Denial of service in Jenkins Core
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in org.kohsuke.stapler.RequestImpl, allowing attackers to trigger a denial of service.
GHSA
Denial of service in Jenkins Core
ghsa·2023-03-10·CVSS 7.5
CVE-2023-27900 [HIGH] CWE-770 Denial of service in Jenkins Core
Denial of service in Jenkins Core
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier, and prior to LTS 2.387.1 is affected by the Apache Commons FileUpload library’s vulnerability CVE-2023-24998. This library is used to process uploaded files via the Stapler web framework (usually through StaplerRequest#getFile) and MultipartFormDataParser in Jenkins.
This allows attackers to cause a denial of service (DoS) by sending crafted requests to HTTP endpoints processing file uploads.
Jenkins 2.394, LTS 2.375.4, and LTS 2.387.1 limits the number of request parts to be processed to 1000. Specific endpoints receiving only simple form submissions have a lower limit.
GHSA
Denial of service in Jenkins Core
ghsa·2023-03-10·CVSS 7.5
CVE-2023-27901 [HIGH] CWE-770 Denial of service in Jenkins Core
Denial of service in Jenkins Core
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in org.kohsuke.stapler.RequestImpl, allowing attackers to trigger a denial of service.
OSV
Apache Commons FileUpload denial of service vulnerability
osv·2023-02-20
CVE-2023-24998 [HIGH] Apache Commons FileUpload denial of service vulnerability
Apache Commons FileUpload denial of service vulnerability
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.
OSV
CVE-2023-24998: Apache Commons FileUpload before 1
osv·2023-02-20·CVSS 7.5
CVE-2023-24998 [HIGH] CVE-2023-24998: Apache Commons FileUpload before 1
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.
GHSA
Apache Commons FileUpload denial of service vulnerability
ghsa·2023-02-20
CVE-2023-24998 [HIGH] CWE-770 Apache Commons FileUpload denial of service vulnerability
Apache Commons FileUpload denial of service vulnerability
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.
Oracle
Oracle Oracle Analytics Risk Matrix: Development Operations (Apache Commons FileUpload) — CVE-2023-24998
vendor_oracle·2025-04-15·CVSS 7.5
CVE-2023-24998 [HIGH] Oracle Oracle Analytics Risk Matrix: Development Operations (Apache Commons FileUpload) — CVE-2023-24998
Oracle Oracle Analytics Risk Matrix: Development Operations (Apache Commons FileUpload) vulnerability
CVE: CVE-2023-24998
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2025 (APR 2025)
Oracle
Oracle Oracle Analytics Risk Matrix: Analytics Server (Apache Commons FileUpload) — CVE-2023-24998
vendor_oracle·2025-01-15·CVSS 7.5
CVE-2023-24998 [HIGH] Oracle Oracle Analytics Risk Matrix: Analytics Server (Apache Commons FileUpload) — CVE-2023-24998
Oracle Oracle Analytics Risk Matrix: Analytics Server (Apache Commons FileUpload) vulnerability
CVE: CVE-2023-24998
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2025 (JAN 2025)
Oracle
Oracle Oracle Commerce Risk Matrix: Workbench (Apache Commons FileUpload) — CVE-2023-24998
vendor_oracle·2024-07-15·CVSS 7.5
CVE-2023-24998 [HIGH] Oracle Oracle Commerce Risk Matrix: Workbench (Apache Commons FileUpload) — CVE-2023-24998
Oracle Oracle Commerce Risk Matrix: Workbench (Apache Commons FileUpload) vulnerability
CVE: CVE-2023-24998
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2024 (JUL 2024)
Oracle
Oracle Oracle Supply Chain Risk Matrix: Install (Apache Commons FileUpload) — CVE-2023-24998
vendor_oracle·2024-04-15·CVSS 7.5
CVE-2023-24998 [HIGH] Oracle Oracle Supply Chain Risk Matrix: Install (Apache Commons FileUpload) — CVE-2023-24998
Oracle Oracle Supply Chain Risk Matrix: Install (Apache Commons FileUpload) vulnerability
CVE: CVE-2023-24998
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2024 (APR 2024)
CISA ICS
Siemens SINEC NMS
cisa_ics·2024-02-15
Siemens SINEC NMS
ICS Advisory
##
Siemens SINEC NMS
Release DateFebruary 15, 2024
Alert CodeICSA-24-046-15
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SINEC NMS
- Vulnerabilities: Out-of-bounds Read, Inadequate Encryption Strength, Double Free, Use After Free, NULL Pointer Dereference, Improper Input Validation, Missing Encryption of Sensitive Data, Allocation of Resources Wit
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Reports (Apache Commons FileUpload) — CVE-2023-24998
vendor_oracle·2024-01-15·CVSS 7.5
CVE-2023-24998 [HIGH] Oracle Oracle Financial Services Applications Risk Matrix: Reports (Apache Commons FileUpload) — CVE-2023-24998
Oracle Oracle Financial Services Applications Risk Matrix: Reports (Apache Commons FileUpload) vulnerability
CVE: CVE-2023-24998
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2024 (JAN 2024)
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Installer (Apache Commons FileUpload) — CVE-2023-24998
vendor_oracle·2023-10-15·CVSS 7.5
CVE-2023-24998 [HIGH] Oracle Oracle Financial Services Applications Risk Matrix: Installer (Apache Commons FileUpload) — CVE-2023-24998
Oracle Oracle Financial Services Applications Risk Matrix: Installer (Apache Commons FileUpload) vulnerability
CVE: CVE-2023-24998
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2023 (OCT 2023)
Oracle
Oracle Oracle Spatial Studio Risk Matrix: Oracle Spatial Studio (Apache Commons FileUpload) — CVE-2023-24998
vendor_oracle·2023-07-15·CVSS 4.3
CVE-2023-24998 [HIGH] Oracle Oracle Spatial Studio Risk Matrix: Oracle Spatial Studio (Apache Commons FileUpload) — CVE-2023-24998
Oracle Oracle Spatial Studio Risk Matrix: Oracle Spatial Studio (Apache Commons FileUpload) vulnerability
CVE: CVE-2023-24998
CVSS: 4.3
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpujul2023 (JUL 2023)
Red Hat
tomcat: Fix for CVE-2023-24998 was incomplete
vendor_redhat·2023-05-22·CVSS 7.5
CVE-2023-28709 [HIGH] CWE-193 tomcat: Fix for CVE-2023-24998 was incomplete
tomcat: Fix for CVE-2023-24998 was incomplete
The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.
A vulnerability has been identified in Apache Tomcat due to an incomplete fix for CVE-2023-24998, which aims to limit the uploaded request parts that can be bypassed in a request. This issue may allow an attacker to use a malicious upload or series of uploads to cause a cras
Oracle
Oracle Oracle Database Server Risk Matrix: Oracle Database Workload Manager (Apache Commons FileUpload) — CVE-2023-24998
vendor_oracle·2023-04-15·CVSS 6.5
CVE-2023-24998 [HIGH] Oracle Oracle Database Server Risk Matrix: Oracle Database Workload Manager (Apache Commons FileUpload) — CVE-2023-24998
Oracle Oracle Database Server Risk Matrix: Oracle Database Workload Manager (Apache Commons FileUpload) vulnerability
CVE: CVE-2023-24998
CVSS: 6.5
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuapr2023 (APR 2023)
Red Hat
Jenkins: Denial of Service attack
vendor_redhat·2023-03-10·CVSS 7.5
CVE-2023-27901 [HIGH] CWE-404 Jenkins: Denial of Service attack
Jenkins: Denial of Service attack
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in org.kohsuke.stapler.RequestImpl, allowing attackers to trigger a denial of service.
A flaw was found in Jenkins. Affected versions of Jenkins use the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in org.kohsuke.stapler.RequestImpl, allowing attackers to trigger a denial of service.
Statement: OpenShift 3.11 is already in the ELS support model phase. The Jenkins components are out of the scope of the ELS support; hence OpenShift 3.11 Jenkins component is marked in this
Red Hat
Jenkins: Denial of Service attack
vendor_redhat·2023-03-10·CVSS 7.5
CVE-2023-27900 [HIGH] CWE-404 Jenkins: Denial of Service attack
Jenkins: Denial of Service attack
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in hudson.util.MultipartFormDataParser, allowing attackers to trigger a denial of service.
A flaw was found in Jenkins. Affected versions of Jenkins use the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in hudson.util.MultipartFormDataParser, allowing attackers to trigger a denial of service.
Statement: OpenShift 3.11 is already in the ELS support model phase. The Jenkins components are out of the scope of the ELS support; hence OpenShift 3.11 Jenkins component is marked
Jenkins
Jenkins Security Advisory 2023-03-08
vendor_jenkins·2023-03-08·CVSS 9.6
CVE-2023-24998 [CRITICAL] Jenkins Security Advisory 2023-03-08
Title: Jenkins Security Advisory 2023-03-08
Jenkins Security Advisory 2023-03-08
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Jenkins (core)
update-center2
Descriptions
XSS vulnerability in plugin manager
SECURITY-3037
/
CVE-2023-27898
Severity (CVSS):
High
Description:
Jenkins 2.270 through 2.393 (b
Red Hat
FileUpload: FileUpload DoS with excessive parts
vendor_redhat·2023-02-20·CVSS 7.5
CVE-2023-24998 [HIGH] CWE-770 FileUpload: FileUpload DoS with excessive parts
FileUpload: FileUpload DoS with excessive parts
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.
Note that, like all of the file upload limits, the
new configuration option (FileUploadBase#setFileCountMax) is not
enabled by default and must be explicitly configured.
A flaw was found in Apache Commons FileUpload, where it does not limit the number of parts being processed in a request. This issue may allow an attacker to use a malicious upload or series of uploads to trigger a denial of service.
While Red Hat Satellite relies upon Apache Tomcat, it does not directly ship it. Tomcat is shipped with Red Hat Enterprise Linux and consumed by
Debian
CVE-2023-24998: libcommons-fileupload-java - Apache Commons FileUpload before 1.5 does not limit the number of request parts ...
vendor_debian·2023·CVSS 7.5
CVE-2023-24998 [HIGH] CVE-2023-24998: libcommons-fileupload-java - Apache Commons FileUpload before 1.5 does not limit the number of request parts ...
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.
Scope: local
bookworm: resolved (fixed in 1.4-2)
bullseye: resolved (fixed in 1.4-1+deb11u1)
forky: resolved (fixed in 1.4-2)
sid: resolved (fixed in 1.4-2)
trixie: resolved (fixed in 1.4-2)
Debian
CVE-2023-28709: tomcat10 - The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-...
vendor_debian·2023·CVSS 7.5
CVE-2023-28709 [HIGH] CVE-2023-28709: tomcat10 - The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-...
The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.
Scope: local
bookworm: resolved (fixed in 10.1.6-1+deb12u1)
forky: resolved (fixed in 10.1.10-1)
sid: resolved (fixed in 10.1.10-1)
trixie: resolved (fixed in 10.1.10-1)
Apache
Apache tomcat: CVE-2023-24998
vendor_apache·CVSS 7.5
CVE-2023-24998 [HIGH] Apache tomcat: CVE-2023-24998
Apache tomcat: CVE-2023-24998
was incomplete. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur. This was fixed with commit 5badf94e . This issue was reported to the Tomcat Security Team on 13 March 2023. The issue was made public on 22 May 2023. Affects: 8.5.85 to 8.5.87 2023-02-24 Fixed in Apache Tomcat 8.5.86 Important: Apache Tomcat information disclosure
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2023/05/22/1https://lists.apache.org/thread/4xl4l09mhwg4vgsk7dxqogcjrobrrdoyhttps://lists.debian.org/debian-lts-announce/2023/10/msg00020.htmlhttps://security.gentoo.org/glsa/202305-37https://www.debian.org/security/2023/dsa-5522http://www.openwall.com/lists/oss-security/2023/05/22/1https://lists.apache.org/thread/4xl4l09mhwg4vgsk7dxqogcjrobrrdoyhttps://lists.debian.org/debian-lts-announce/2023/10/msg00020.htmlhttps://lists.debian.org/debian-lts-announce/2025/07/msg00008.htmlhttps://security.gentoo.org/glsa/202305-37https://security.netapp.com/advisory/ntap-20230302-0013/https://security.netapp.com/advisory/ntap-20241108-0002/https://www.debian.org/security/2023/dsa-5522
2023-02-20
Published