Vulnerability · Published May 22, 2023 · Assigned by apache
CVE-2023-28709Apache Tomcat: Fix for CVE-2023-24998 is incomplete
High 7.5
In plain English
A high-severity security flaw in Apache Tomcat from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 48.0% (higher than 99% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | tomcat | 1:9.0.62-27.el8_9 | ALSA-2023:7065 |
| AlmaLinux:9 | tomcat | 1:9.0.62-37.el9_3 | ALSA-2023:6570 |
| AlmaLinux:8 | tomcat-admin-webapps | 1:9.0.62-27.el8_9 | ALSA-2023:7065 |
| AlmaLinux:9 | tomcat-admin-webapps | 1:9.0.62-37.el9_3 | ALSA-2023:6570 |
| AlmaLinux:8 | tomcat-docs-webapp | 1:9.0.62-27.el8_9 | ALSA-2023:7065 |
| AlmaLinux:9 | tomcat-docs-webapp | 1:9.0.62-37.el9_3 | ALSA-2023:6570 |
| AlmaLinux:8 | tomcat-el-3.0-api | 1:9.0.62-27.el8_9 | ALSA-2023:7065 |
| AlmaLinux:9 | tomcat-el-3.0-api | 1:9.0.62-37.el9_3 | ALSA-2023:6570 |
| AlmaLinux:8 | tomcat-jsp-2.3-api | 1:9.0.62-27.el8_9 | ALSA-2023:7065 |
| AlmaLinux:9 | tomcat-jsp-2.3-api | 1:9.0.62-37.el9_3 | ALSA-2023:6570 |
| AlmaLinux:8 | tomcat-lib | 1:9.0.62-27.el8_9 | ALSA-2023:7065 |
| AlmaLinux:9 | tomcat-lib | 1:9.0.62-37.el9_3 | ALSA-2023:6570 |
| AlmaLinux:8 | tomcat-servlet-4.0-api | 1:9.0.62-27.el8_9 | ALSA-2023:7065 |
| AlmaLinux:9 | tomcat-servlet-4.0-api | 1:9.0.62-37.el9_3 | ALSA-2023:6570 |
| AlmaLinux:8 | tomcat-webapps | 1:9.0.62-27.el8_9 | ALSA-2023:7065 |
| AlmaLinux:9 | tomcat-webapps | 1:9.0.62-37.el9_3 | ALSA-2023:6570 |
| Debian:12 | tomcat10 | 10.1.6-1+deb12u1 | DEBIAN-CVE-2023-28709 |
| Debian:12 | tomcat10 | 10.1.6-1+deb12u1 | DSA-5521-1 |
| Debian:13 | tomcat10 | 10.1.10-1 | DEBIAN-CVE-2023-28709 |
| Debian:14 | tomcat10 | 10.1.10-1 | DEBIAN-CVE-2023-28709 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.74 | GHSA-cx6h-86xw-9x34 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 11.0.0-M5 | GHSA-cx6h-86xw-9x34 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 10.1.8 | GHSA-cx6h-86xw-9x34 |
| Maven | org.apache.tomcat:tomcat-coyote | 8.5.88 | GHSA-cx6h-86xw-9x34 |
| Ubuntu:25.10 | tomcat10 | no fix listed | UBUNTU-CVE-2023-28709 |
| Ubuntu:26.04:LTS | tomcat10 | no fix listed | UBUNTU-CVE-2023-28709 |
| Ubuntu:25.10 | tomcat11 | no fix listed | UBUNTU-CVE-2023-28709 |
| Ubuntu:26.04:LTS | tomcat11 | no fix listed | UBUNTU-CVE-2023-28709 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Tomcat | 11.0.0-M2 – through 11.0.0-M410.1.5 – through 10.1.79.0.71 – through 9.0.738.5.85 – through 8.5.87 |
Weakness: CWE-193