Skip to content
Fencer Vulns
high 7.5

CVE-2023-24998 in the critical feed json

Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts

published 2023-02-20 3 y ago modified 2026-10-07 32 d ago also GHSA-hfrx-6qgj-fp6c , EUVD-2023-0720

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
48.8%
EPSS 48.8% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.

Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.

Patch / fix

  • maven commons-fileupload:commons-fileupload 1.5
  • maven org.apache.tomcat:tomcat-coyote 8.5.88, 9.0.71, 10.1.5, 11.0.0-M5
  • maven org.apache.tomcat.embed:tomcat-embed-core 8.5.88, 9.0.71, 10.1.5, 11.0.0-M5
  • maven org.apache.tomcat:tomcat-catalina 8.5.88, 9.0.71, 10.1.5, 11.0.0-M5
  • Apache Software Foundation Apache Commons FileUpload 1.5
  • tomcat9 Debian 14, Debian 13, Debian 12 9.0.70-2
  • tomcat10 Debian 14, Debian 13, Debian 12 10.1.5-1
  • libcommons-fileupload-java Debian 14, Debian 13, Debian 12 1.4-2

debian advisories DEBIAN-CVE-2023-24998

  • jenkins ocp tools 4.13 2.387.3.1684911776-3.el8
  • jenkins-2-plugins ocp tools 4.13 4.13.1684911916-1.el8
  • tomcat RHEL 8 1:9.0.62-27.el8_9
  • tomcat-lib RHEL 8 1:9.0.62-27.el8_9
  • tomcat-webapps RHEL 8 1:9.0.62-27.el8_9
  • tomcat-el-3.0-api RHEL 8 1:9.0.62-27.el8_9
  • tomcat-docs-webapp RHEL 8 1:9.0.62-27.el8_9
  • tomcat-jsp-2.3-api RHEL 8 1:9.0.62-27.el8_9

red hat advisories RHSA-2023:3299RHSA-2023:7065RHSA-2023:6570RHSA-2023:4909RHSA-2024:3814

  • tomcat SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +11 more 9.0.75-150200.41.1
  • apache-commons-fileupload SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +11 more 1.5-150200.3.9.1
  • tomcat SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +9 more 9.0.43-150200.35.1
  • jakarta-commons-fileupload SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +5 more 1.1.1-122.8.1
  • jakarta-commons-fileupload SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLE High Performance Computing 15 SP1-LTSS +1 more 1.1.1-150000.4.8.1
  • tomcat SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +4 more 9.0.36-3.99.1
  • tomcat SLES 12 SP2-BCL 8.0.53-29.63.1
  • tomcat SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 9.0.115-3.160.1

suse advisories SUSE-SU-2026:1058-1SUSE-SU-2023:2505-1SUSE-SU-2023:2390-1SUSE-SU-2023:1769-1SUSE-SU-2023:0758-1SUSE-SU-2023:0730-1

  • tomcat openSUSE Tumbleweed 9.0.43-14.1
  • apache-commons-fileupload openSUSE Tumbleweed 1.5-1.1
  • tomcat10 openSUSE Tumbleweed 10.1.14-1.1

opensuse advisories openSUSE-SU-2024:12750-1openSUSE-SU-2024:12950-1openSUSE-SU-2024:13441-1

  • tomcat AlmaLinux 8 1:9.0.62-27.el8_9
  • tomcat-lib AlmaLinux 8 1:9.0.62-27.el8_9
  • tomcat-webapps AlmaLinux 8 1:9.0.62-27.el8_9
  • tomcat-el-3.0-api AlmaLinux 8 1:9.0.62-27.el8_9
  • tomcat-docs-webapp AlmaLinux 8 1:9.0.62-27.el8_9
  • tomcat-jsp-2.3-api AlmaLinux 8 1:9.0.62-27.el8_9
  • tomcat-admin-webapps AlmaLinux 8 1:9.0.62-27.el8_9
  • tomcat-servlet-4.0-api AlmaLinux 8 1:9.0.62-27.el8_9

almalinux advisories ALSA-2023:7065ALSA-2023:6570

  • tomcat10 Arch Linux 10.1.5-1
  • tomcat9 Arch Linux 9.0.71-1

arch linux advisories AVG-2829AVG-2830

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-24998 updated cvss 6.5

FileUpload: FileUpload DoS with excessive parts

  • Red Hat Migration Toolkit for Applications 6 org.keycloak-keycloak-parent Red Hat build of Debezium 1 commons-fileupload Red Hat Data Grid 8 tomcat, commons-fileupload
    affected: no fix planned “Will not fix”
  • Red Hat Decision Manager 7 tomcat, drools-core Red Hat Enterprise Linux 6 tomcat6, tomcat6-lib, tomcat6-log4j, tomcat6-javadoc, tomcat6-webapps, tomcat6-el-2.1-api, +4 more
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 7 tomcat, tomcat-lib, tomcat-jsvc, tomcat-javadoc, tomcat-webapps, tomcat-el-2.2-api, +4 more
    affected: no fix available
  • Red Hat Enterprise Linux 8 pki-servlet-engine, pki-servlet-4.0-api Red Hat Enterprise Linux 9 pki-servlet-engine, pki-servlet-4.0-api
    affected: no fix planned “Will not fix”
  • Red Hat Fuse 7 tomcat, commons-fileupload
    affected: no fix planned “Out of support scope”
  • Red Hat Integration Camel K 1 camel, tomcat
    affected: no fix available
  • Red Hat Integration Camel Quarkus 1 camel-quarkus camel-quarkus
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Data Grid 7 tomcat, commons-fileupload Red Hat JBoss Data Virtualization 6 teiid teiid Red Hat JBoss Enterprise Application Platform 6 tomcat, commons-fileupload
    affected: no fix planned “Out of support scope”
show 16 more
  • Red Hat JBoss Enterprise Application Platform Expansion Pack log4j, tomcat
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Fuse 6 tomcat, commons-fileupload Red Hat JBoss Fuse Service Works 6 tomcat, commons-fileupload Red Hat JBoss Web Server 3 tomcat7 tomcat7, tomcat8 tomcat8, FileUpload FileUpload
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Application Runtimes tomcat, httl httl
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 3.11 jenkins
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 jenkins
    affected: no fix available
  • Red Hat OpenStack Platform 13 (Queens) tomcat, jenkins Red Hat Process Automation 7 tomcat, drools-core
    affected: no fix planned “Out of support scope”
  • Red Hat support for Spring Boot tomcat
    affected: no fix available
  • Red Hat JWS 5.7.4 release
    fixed: vendor fix RHSA-2023:4910
  • Red Hat OpenShift Developer Tools and Services for OCP 4.13 jenkins 2.387.3.1684911776-3.el8
    fixed: vendor fix RHSA-2023:3299
  • Red Hat Enterprise Linux AppStream (v. 8) tomcat 9.0.62-27.el8_9, tomcat-lib 9.0.62-27.el8_9, tomcat-webapps 9.0.62-27.el8_9, tomcat-el-3.0-api 9.0.62-27.el8_9, tomcat-docs-webapp 9.0.62-27.el8_9, tomcat-jsp-2.3-api 9.0.62-27.el8_9, +2 more
    fixed: vendor fix RHSA-2023:7065
  • Red Hat Enterprise Linux AppStream (v. 9) tomcat 9.0.62-37.el9_3, tomcat-lib 9.0.62-37.el9_3, tomcat-webapps 9.0.62-37.el9_3, tomcat-el-3.0-api 9.0.62-37.el9_3, tomcat-docs-webapp 9.0.62-37.el9_3, tomcat-jsp-2.3-api 9.0.62-37.el9_3, +2 more
    fixed: vendor fix RHSA-2023:6570
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) tomcat 9.0.87-1.el8_8.2, tomcat-lib 9.0.87-1.el8_8.2, tomcat-webapps 9.0.87-1.el8_8.2, tomcat-el-3.0-api 9.0.87-1.el8_8.2, tomcat-docs-webapp 9.0.87-1.el8_8.2, tomcat-jsp-2.3-api 9.0.87-1.el8_8.2, +2 more
    fixed: vendor fix RHSA-2024:3814
  • Red Hat JBoss Web Server 5.7 for RHEL 7 Server jws5-tomcat 9.0.62-15.redhat_00013.1.el7jws, jws5-tomcat-lib 9.0.62-15.redhat_00013.1.el7jws, jws5-tomcat-javadoc 9.0.62-15.redhat_00013.1.el7jws, jws5-tomcat-selinux 9.0.62-15.redhat_00013.1.el7jws, jws5-tomcat-webapps 9.0.62-15.redhat_00013.1.el7jws, jws5-tomcat-java-jdk8 9.0.62-15.redhat_00013.1.el7jws, +6 more Red Hat JBoss Web Server 5.7 for RHEL 8 jws5-tomcat 9.0.62-15.redhat_00013.1.el8jws, jws5-tomcat-lib 9.0.62-15.redhat_00013.1.el8jws, jws5-tomcat-javadoc 9.0.62-15.redhat_00013.1.el8jws, jws5-tomcat-selinux 9.0.62-15.redhat_00013.1.el8jws, jws5-tomcat-webapps 9.0.62-15.redhat_00013.1.el8jws, jws5-tomcat-el-3.0-api 9.0.62-15.redhat_00013.1.el8jws, +4 more Red Hat JBoss Web Server 5.7 for RHEL 9 jws5-tomcat 9.0.62-15.redhat_00013.1.el9jws, jws5-tomcat-lib 9.0.62-15.redhat_00013.1.el9jws, jws5-tomcat-javadoc 9.0.62-15.redhat_00013.1.el9jws, jws5-tomcat-selinux 9.0.62-15.redhat_00013.1.el9jws, jws5-tomcat-webapps 9.0.62-15.redhat_00013.1.el9jws, jws5-tomcat-el-3.0-api 9.0.62-15.redhat_00013.1.el9jws, +4 more
    fixed: vendor fix RHSA-2023:4909
  • Red Hat RHINT Camel-Springboot 3.20.1
    fixed: vendor fix RHSA-2023:2100
  • Red Hat RHPAM 7.13.4 async
    fixed: vendor fix RHSA-2023:4983
  • Red Hat A-MQ Clients 2 log4j, tomcat Red Hat OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins 4.13.1684911916-1.el8 Red Hat AMQ Broker 7 artemis artemis Red Hat Enterprise Linux 8 pki-servlet-container Red Hat JBoss Enterprise Application Platform 7 tomcat Red Hat JBoss Web Server 5.7 for RHEL 7 Server jws5-tomcat-native 1.2.31-15.redhat_15.el7jws
    not affected: vulnerable code not present

3 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
17 mo ago

Exploit prediction

48.79% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven commons-fileupload:commons-fileupload
<1.5
1.5
maven org.apache.tomcat:tomcat-coyote
>=10.1.0-M1, <10.1.5
>=11.0.0-M2, <11.0.0-M5
>=8.5.85, <8.5.88
>=9.0.0-M1, <9.0.71
10.1.5
11.0.0-M5
8.5.88
9.0.71
maven org.apache.tomcat.embed:tomcat-embed-core
>=10.1.0-M1, <10.1.5
>=11.0.0-M2, <11.0.0-M5
>=8.5.85, <8.5.88
>=9.0.0-M1, <9.0.71
10.1.5
11.0.0-M5
8.5.88
9.0.71
maven org.apache.tomcat:tomcat-catalina
>=10.1.0-M1, <10.1.5
>=11.0.0-M2, <11.0.0-M5
>=8.5.85, <8.5.88
>=9.0.0-M1, <9.0.71
10.1.5
11.0.0-M5
8.5.88
9.0.71

Affected products

  • Apache Software Foundation Apache Commons FileUpload
  • Apache Software Foundation Apache Tomcat

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.