Vulnerability · Published Feb 20, 2023 · Assigned by apache
CVE-2023-24998Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts
High 7.5
In plain English
A high-severity resource allocation without limits in Apache Commons FileUpload from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 48.8% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | tomcat | 1:9.0.62-27.el8_9 | ALSA-2023:7065 |
| AlmaLinux:9 | tomcat | 1:9.0.62-37.el9_3 | ALSA-2023:6570 |
| AlmaLinux:8 | tomcat-admin-webapps | 1:9.0.62-27.el8_9 | ALSA-2023:7065 |
| AlmaLinux:9 | tomcat-admin-webapps | 1:9.0.62-37.el9_3 | ALSA-2023:6570 |
| AlmaLinux:8 | tomcat-docs-webapp | 1:9.0.62-27.el8_9 | ALSA-2023:7065 |
| AlmaLinux:9 | tomcat-docs-webapp | 1:9.0.62-37.el9_3 | ALSA-2023:6570 |
| AlmaLinux:8 | tomcat-el-3.0-api | 1:9.0.62-27.el8_9 | ALSA-2023:7065 |
| AlmaLinux:9 | tomcat-el-3.0-api | 1:9.0.62-37.el9_3 | ALSA-2023:6570 |
| AlmaLinux:8 | tomcat-jsp-2.3-api | 1:9.0.62-27.el8_9 | ALSA-2023:7065 |
| AlmaLinux:9 | tomcat-jsp-2.3-api | 1:9.0.62-37.el9_3 | ALSA-2023:6570 |
| AlmaLinux:8 | tomcat-lib | 1:9.0.62-27.el8_9 | ALSA-2023:7065 |
| AlmaLinux:9 | tomcat-lib | 1:9.0.62-37.el9_3 | ALSA-2023:6570 |
| AlmaLinux:8 | tomcat-servlet-4.0-api | 1:9.0.62-27.el8_9 | ALSA-2023:7065 |
| AlmaLinux:9 | tomcat-servlet-4.0-api | 1:9.0.62-37.el9_3 | ALSA-2023:6570 |
| AlmaLinux:8 | tomcat-webapps | 1:9.0.62-27.el8_9 | ALSA-2023:7065 |
| AlmaLinux:9 | tomcat-webapps | 1:9.0.62-37.el9_3 | ALSA-2023:6570 |
| Debian:12 | libcommons-fileupload-java | 1.4-2 | DEBIAN-CVE-2023-24998 |
| Debian:13 | libcommons-fileupload-java | 1.4-2 | DEBIAN-CVE-2023-24998 |
| Debian:14 | libcommons-fileupload-java | 1.4-2 | DEBIAN-CVE-2023-24998 |
| Debian:12 | tomcat10 | 10.1.5-1 | DEBIAN-CVE-2023-24998 |
| Debian:13 | tomcat10 | 10.1.5-1 | DEBIAN-CVE-2023-24998 |
| Debian:14 | tomcat10 | 10.1.5-1 | DEBIAN-CVE-2023-24998 |
| Debian:12 | tomcat9 | 9.0.70-2 | DEBIAN-CVE-2023-24998 |
| Debian:13 | tomcat9 | 9.0.70-2 | DEBIAN-CVE-2023-24998 |
| Debian:14 | tomcat9 | 9.0.70-2 | DEBIAN-CVE-2023-24998 |
| Maven | commons-fileupload:commons-fileupload | 1.5 | GHSA-hfrx-6qgj-fp6c |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 8.5.88 | GHSA-hfrx-6qgj-fp6c |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 11.0.0-M5 | GHSA-hfrx-6qgj-fp6c |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 10.1.5 | GHSA-hfrx-6qgj-fp6c |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.71 | GHSA-hfrx-6qgj-fp6c |
| Maven | org.apache.tomcat:tomcat-catalina | 11.0.0-M5 | GHSA-hfrx-6qgj-fp6c |
| Maven | org.apache.tomcat:tomcat-catalina | 8.5.88 | GHSA-hfrx-6qgj-fp6c |
| Maven | org.apache.tomcat:tomcat-catalina | 9.0.71 | GHSA-hfrx-6qgj-fp6c |
| Maven | org.apache.tomcat:tomcat-catalina | 10.1.5 | GHSA-hfrx-6qgj-fp6c |
| Maven | org.apache.tomcat:tomcat-coyote | 8.5.88 | GHSA-hfrx-6qgj-fp6c |
| Maven | org.apache.tomcat:tomcat-coyote | 9.0.71 | GHSA-hfrx-6qgj-fp6c |
| Maven | org.apache.tomcat:tomcat-coyote | 11.0.0-M5 | GHSA-hfrx-6qgj-fp6c |
| Maven | org.apache.tomcat:tomcat-coyote | 10.1.5 | GHSA-hfrx-6qgj-fp6c |
| Ubuntu:22.04:LTS | libcommons-fileupload-java | no fix listed | UBUNTU-CVE-2023-24998 |
| Ubuntu:24.04:LTS | libcommons-fileupload-java | no fix listed | UBUNTU-CVE-2023-24998 |
| Ubuntu:25.10 | libcommons-fileupload-java | no fix listed | UBUNTU-CVE-2023-24998 |
| Ubuntu:26.04:LTS | libcommons-fileupload-java | no fix listed | UBUNTU-CVE-2023-24998 |
| Ubuntu:26.10 | libcommons-fileupload-java | no fix listed | UBUNTU-CVE-2023-24998 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Commons FileUpload | 0 – before 1.5 |
| Apache Software Foundation | Apache Tomcat | 11.0.0-M110.0.0-M1 – through 10.1.49.0.0-M1 – through 9.0.708.5.0 – through 8.5.84 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://lists.apache.org/thread/4xl4l09mhwg4vgsk7dxqogcjrobrrdoy vendor-advisory
- http://www.openwall.com/lists/oss-security/2023/05/22/1
- https://security.gentoo.org/glsa/202305-37
- https://www.debian.org/security/2023/dsa-5522
- https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html
- https://security.netapp.com/advisory/ntap-20230302-0013/
- https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html
- https://security.netapp.com/advisory/ntap-20241108-0002/