p PatchFirst

CVE-2023-24998

CVE-2023-24998 · Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.

CVSS 7.5 · High · EPSS 48.8% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • apache commons fileupload

    Versions
    • ≥ 0, < 1.5: Affected (semver)

    Update to 1.5

  • apache tomcat

    Versions
    • 11.0.0-M1: Affected
    • ≥ 10.0.0-M1, ≤ 10.1.4: Affected (semver)
    • ≥ 9.0.0-M1, ≤ 9.0.70: Affected (semver)
    • ≥ 8.5.0, ≤ 8.5.84: Affected (semver)

    No fix published

  • libcommons-fileupload-java Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.4-2

    Update to 1.4-2

  • libcommons-fileupload-java Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.4-2

    Update to 1.4-2

  • libcommons-fileupload-java Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.4-2

    Update to 1.4-2

  • tomcat10 Debian:12

    Affected ranges
    • ECOSYSTEM: < 10.1.5-1

    Update to 10.1.5-1

  • tomcat10 Debian:13

    Affected ranges
    • ECOSYSTEM: < 10.1.5-1

    Update to 10.1.5-1

  • tomcat10 Debian:14

    Affected ranges
    • ECOSYSTEM: < 10.1.5-1

    Update to 10.1.5-1

  • tomcat9 Debian:12

    Affected ranges
    • ECOSYSTEM: < 9.0.70-2

    Update to 9.0.70-2

  • tomcat9 Debian:13

    Affected ranges
    • ECOSYSTEM: < 9.0.70-2

    Update to 9.0.70-2

  • tomcat9 Debian:14

    Affected ranges
    • ECOSYSTEM: < 9.0.70-2

    Update to 9.0.70-2

  • libcommons-fileupload-java Ubuntu:16.04:LTS

    Versions
    • 1.3.1-1
    • 1.3.1-2
    • 1.3.1-2ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libcommons-fileupload-java Ubuntu:18.04:LTS

    Versions
    • 1.3.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libcommons-fileupload-java Ubuntu:20.04:LTS

    Versions
    • 1.3.3-1
    • 1.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libcommons-fileupload-java Ubuntu:22.04:LTS

    Versions
    • 1.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libcommons-fileupload-java Ubuntu:24.04:LTS

    Versions
    • 1.4-2
    • 1.5-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libcommons-fileupload-java Ubuntu:25.10

    Versions
    • 1.5-1
    • 1.5-1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libcommons-fileupload-java Ubuntu:26.10

    Versions
    • 1.5-1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libcommons-fileupload-java Ubuntu:26.04:LTS

    Versions
    • 1.5-1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →