CVE-2023-24998
Fixed in a distro release EPSS 49%CVSS 7.5
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.
Products: Apache Software Foundation Apache Commons FileUpload, Apache Software Foundation Apache Tomcat
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | commons-fileupload:commons-fileupload | 1.5 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 10.1.5 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.71 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 8.5.88 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 11.0.0-M5 |
| Maven | org.apache.tomcat:tomcat-catalina | 10.1.5 |
| Maven | org.apache.tomcat:tomcat-catalina | 11.0.0-M5 |
| Maven | org.apache.tomcat:tomcat-catalina | 8.5.88 |
| Maven | org.apache.tomcat:tomcat-catalina | 9.0.71 |
| Maven | org.apache.tomcat:tomcat-coyote | 9.0.71 |
| Maven | org.apache.tomcat:tomcat-coyote | 8.5.88 |
| Maven | org.apache.tomcat:tomcat-coyote | 11.0.0-M5 |
| Maven | org.apache.tomcat:tomcat-coyote | 10.1.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | tomcat | 1:9.0.62-27.el8_9 |
| AlmaLinux 8 | tomcat-admin-webapps | 1:9.0.62-27.el8_9 |
| AlmaLinux 8 | tomcat-docs-webapp | 1:9.0.62-27.el8_9 |
| AlmaLinux 8 | tomcat-el-3.0-api | 1:9.0.62-27.el8_9 |
| AlmaLinux 8 | tomcat-jsp-2.3-api | 1:9.0.62-27.el8_9 |
| AlmaLinux 8 | tomcat-lib | 1:9.0.62-27.el8_9 |
| AlmaLinux 8 | tomcat-servlet-4.0-api | 1:9.0.62-27.el8_9 |
| AlmaLinux 8 | tomcat-webapps | 1:9.0.62-27.el8_9 |
| AlmaLinux 9 | tomcat | 1:9.0.62-37.el9_3 |
| AlmaLinux 9 | tomcat-admin-webapps | 1:9.0.62-37.el9_3 |
| AlmaLinux 9 | tomcat-docs-webapp | 1:9.0.62-37.el9_3 |
| AlmaLinux 9 | tomcat-el-3.0-api | 1:9.0.62-37.el9_3 |
| AlmaLinux 9 | tomcat-jsp-2.3-api | 1:9.0.62-37.el9_3 |
| AlmaLinux 9 | tomcat-lib | 1:9.0.62-37.el9_3 |
| AlmaLinux 9 | tomcat-servlet-4.0-api | 1:9.0.62-37.el9_3 |
| AlmaLinux 9 | tomcat-webapps | 1:9.0.62-37.el9_3 |
| Chainguard | jenkins | 2.395-r0 |
| Chainguard | jenkins-compat | 2.395-r0 |
| Chainguard | jenkins-remoting | 2.395-r0 |
| Chainguard | tomcat-8.5.87 | no fix |
| Debian 10 | tomcat9 | 9.0.31-1~deb10u9 |
| Debian 11 | libcommons-fileupload-java | 1.4-1+deb11u1 |
| Debian 11 | tomcat9 | 9.0.43-2~deb11u7 |
| Debian 12 | libcommons-fileupload-java | 1.4-2 |
| Debian 12 | tomcat10 | 10.1.5-1 |
| Debian 12 | tomcat9 | 9.0.70-2 |
| Debian 13 | libcommons-fileupload-java | 1.4-2 |
| Debian 13 | tomcat10 | 10.1.5-1 |
| Debian 13 | tomcat9 | 9.0.70-2 |
| Debian 14 | libcommons-fileupload-java | 1.4-2 |
| Debian 14 | tomcat10 | 10.1.5-1 |
| Debian 14 | tomcat9 | 9.0.70-2 |
| Red Hat Enterprise Linux 8 | tomcat | 1:9.0.62-27.el8_9 |
| Red Hat Enterprise Linux 8 | tomcat-admin-webapps | 1:9.0.62-27.el8_9 |
| Red Hat Enterprise Linux 8 | tomcat-docs-webapp | 1:9.0.62-27.el8_9 |
| Red Hat Enterprise Linux 8 | tomcat-el-3.0-api | 1:9.0.62-27.el8_9 |
| Red Hat Enterprise Linux 8 | tomcat-jsp-2.3-api | 1:9.0.62-27.el8_9 |
| Red Hat Enterprise Linux 8 | tomcat-lib | 1:9.0.62-27.el8_9 |
| Red Hat Enterprise Linux 8 | tomcat-servlet-4.0-api | 1:9.0.62-27.el8_9 |
| Red Hat Enterprise Linux 8 | tomcat-webapps | 1:9.0.62-27.el8_9 |
| Red Hat Enterprise Linux 9 | tomcat | 1:9.0.62-37.el9_3 |
| Red Hat Enterprise Linux 9 | tomcat-admin-webapps | 1:9.0.62-37.el9_3 |
| Red Hat Enterprise Linux 9 | tomcat-docs-webapp | 1:9.0.62-37.el9_3 |
| Red Hat Enterprise Linux 9 | tomcat-el-3.0-api | 1:9.0.62-37.el9_3 |
| Red Hat Enterprise Linux 9 | tomcat-jsp-2.3-api | 1:9.0.62-37.el9_3 |
| Red Hat Enterprise Linux 9 | tomcat-lib | 1:9.0.62-37.el9_3 |
| Red Hat Enterprise Linux 9 | tomcat-servlet-4.0-api | 1:9.0.62-37.el9_3 |
| Red Hat Enterprise Linux 9 | tomcat-webapps | 1:9.0.62-37.el9_3 |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat | 0:9.0.62-15.redhat_00013.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat | 0:9.0.62-15.redhat_00013.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat | 0:9.0.62-15.redhat_00013.1.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-admin-webapps | 0:9.0.62-15.redhat_00013.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-admin-webapps | 0:9.0.62-15.redhat_00013.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-admin-webapps | 0:9.0.62-15.redhat_00013.1.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-docs-webapp | 0:9.0.62-15.redhat_00013.1.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-docs-webapp | 0:9.0.62-15.redhat_00013.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-docs-webapp | 0:9.0.62-15.redhat_00013.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-el-3.0-api | 0:9.0.62-15.redhat_00013.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-el-3.0-api | 0:9.0.62-15.redhat_00013.1.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-el-3.0-api | 0:9.0.62-15.redhat_00013.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-java-jdk11 | 0:9.0.62-15.redhat_00013.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-java-jdk8 | 0:9.0.62-15.redhat_00013.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-javadoc | 0:9.0.62-15.redhat_00013.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-javadoc | 0:9.0.62-15.redhat_00013.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-javadoc | 0:9.0.62-15.redhat_00013.1.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-jsp-2.3-api | 0:9.0.62-15.redhat_00013.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-jsp-2.3-api | 0:9.0.62-15.redhat_00013.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-jsp-2.3-api | 0:9.0.62-15.redhat_00013.1.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-lib | 0:9.0.62-15.redhat_00013.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-lib | 0:9.0.62-15.redhat_00013.1.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-lib | 0:9.0.62-15.redhat_00013.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-native | 0:1.2.31-15.redhat_15.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-native | 0:1.2.31-15.redhat_15.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-native | 0:1.2.31-15.redhat_15.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-native-debuginfo | 0:1.2.31-15.redhat_15.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-native-debuginfo | 0:1.2.31-15.redhat_15.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-native-debuginfo | 0:1.2.31-15.redhat_15.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-selinux | 0:9.0.62-15.redhat_00013.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-selinux | 0:9.0.62-15.redhat_00013.1.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-selinux | 0:9.0.62-15.redhat_00013.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-servlet-4.0-api | 0:9.0.62-15.redhat_00013.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-servlet-4.0-api | 0:9.0.62-15.redhat_00013.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-servlet-4.0-api | 0:9.0.62-15.redhat_00013.1.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-webapps | 0:9.0.62-15.redhat_00013.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-webapps | 0:9.0.62-15.redhat_00013.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-webapps | 0:9.0.62-15.redhat_00013.1.el8jws |
| Red Hat ocp tools 4.13 | jenkins | 0:2.387.3.1684911776-3.el8 |
| Red Hat ocp tools 4.13 | jenkins-2-plugins | 0:4.13.1684911916-1.el8 |
| Red Hat rhel eus 8.8 | tomcat | 1:9.0.87-1.el8_8.2 |
| Red Hat rhel eus 8.8 | tomcat-admin-webapps | 1:9.0.87-1.el8_8.2 |
| Red Hat rhel eus 8.8 | tomcat-docs-webapp | 1:9.0.87-1.el8_8.2 |
| Red Hat rhel eus 8.8 | tomcat-el-3.0-api | 1:9.0.87-1.el8_8.2 |
| Red Hat rhel eus 8.8 | tomcat-jsp-2.3-api | 1:9.0.87-1.el8_8.2 |
| Red Hat rhel eus 8.8 | tomcat-lib | 1:9.0.87-1.el8_8.2 |
| Red Hat rhel eus 8.8 | tomcat-servlet-4.0-api | 1:9.0.87-1.el8_8.2 |
| Red Hat rhel eus 8.8 | tomcat-webapps | 1:9.0.87-1.el8_8.2 |
| SUSE Enterprise Storage 7 | apache-commons-fileupload | 1.5-150200.3.9.1 |
| SUSE Enterprise Storage 7 | tomcat | 9.0.75-150200.41.1 |
| SUSE Enterprise Storage 7 | tomcat | 9.0.43-150200.35.1 |
| SUSE Enterprise Storage 7.1 | apache-commons-fileupload | 1.5-150200.3.9.1 |
| SUSE Enterprise Storage 7.1 | tomcat | 9.0.75-150200.41.1 |
| SUSE Enterprise Storage 7.1 | tomcat | 9.0.43-150200.35.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | jakarta-commons-fileupload | 1.1.1-150000.4.8.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | tomcat | 9.0.36-150100.4.87.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | apache-commons-fileupload | 1.5-150200.3.9.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | tomcat | 9.0.43-150200.35.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | tomcat | 9.0.75-150200.41.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS | apache-commons-fileupload | 1.5-150200.3.9.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS | tomcat | 9.0.43-150200.35.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS | tomcat | 9.0.75-150200.41.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | apache-commons-fileupload | 1.5-150200.3.9.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | tomcat | 9.0.75-150200.41.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | tomcat | 9.0.43-150200.35.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP4 | apache-commons-fileupload | 1.5-150200.3.9.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP4 | tomcat | 9.0.43-150200.35.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP4 | tomcat | 9.0.75-150200.41.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP5 | apache-commons-fileupload | 1.5-150200.3.9.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP5 | tomcat | 9.0.75-150200.41.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | jakarta-commons-fileupload | 1.1.1-122.8.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | tomcat | 8.0.53-29.63.1 |
| SUSE Linux Enterprise Server 12 SP4-ESPOS | jakarta-commons-fileupload | 1.1.1-122.8.1 |
| SUSE Linux Enterprise Server 12 SP4-ESPOS | tomcat | 9.0.36-3.99.1 |
| SUSE Linux Enterprise Server 12 SP4-LTSS | jakarta-commons-fileupload | 1.1.1-122.8.1 |
| SUSE Linux Enterprise Server 12 SP4-LTSS | tomcat | 9.0.36-3.99.1 |
| SUSE Linux Enterprise Server 12 SP5 | jakarta-commons-fileupload | 1.1.1-122.8.1 |
| SUSE Linux Enterprise Server 12 SP5 | tomcat | 9.0.36-3.99.1 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | tomcat | 9.0.115-3.160.1 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | jakarta-commons-fileupload | 1.1.1-150000.4.8.1 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | tomcat | 9.0.36-150100.4.87.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | apache-commons-fileupload | 1.5-150200.3.9.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | tomcat | 9.0.43-150200.35.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | tomcat | 9.0.75-150200.41.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | apache-commons-fileupload | 1.5-150200.3.9.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | tomcat | 9.0.75-150200.41.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | tomcat | 9.0.43-150200.35.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | tomcat | 9.0.115-3.160.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | jakarta-commons-fileupload | 1.1.1-122.8.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | tomcat | 9.0.36-3.99.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | jakarta-commons-fileupload | 1.1.1-122.8.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | tomcat | 9.0.36-3.99.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | jakarta-commons-fileupload | 1.1.1-150000.4.8.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | tomcat | 9.0.36-150100.4.87.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | apache-commons-fileupload | 1.5-150200.3.9.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | tomcat | 9.0.75-150200.41.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | tomcat | 9.0.43-150200.35.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | apache-commons-fileupload | 1.5-150200.3.9.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | tomcat | 9.0.75-150200.41.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | tomcat | 9.0.43-150200.35.1 |
| SUSE Manager Server 4.2 | apache-commons-fileupload | 1.5-150200.3.9.1 |
| SUSE Manager Server 4.2 | tomcat | 9.0.43-150200.35.1 |
| SUSE Manager Server 4.2 | tomcat | 9.0.75-150200.41.1 |
| SUSE OpenStack Cloud 9 | jakarta-commons-fileupload | 1.1.1-122.8.1 |
| SUSE OpenStack Cloud 9 | tomcat | 9.0.36-3.99.1 |
| SUSE OpenStack Cloud Crowbar 9 | jakarta-commons-fileupload | 1.1.1-122.8.1 |
| SUSE OpenStack Cloud Crowbar 9 | tomcat | 9.0.36-3.99.1 |
| Ubuntu 16.04 LTS | libcommons-fileupload-java | no fix |
| Ubuntu 18.04 LTS | libcommons-fileupload-java | no fix |
| Ubuntu 20.04 LTS | libcommons-fileupload-java | no fix |
| Ubuntu 22.04 LTS | libcommons-fileupload-java | no fix |
| Ubuntu 24.04 LTS | libcommons-fileupload-java | no fix |
| Ubuntu 25.10 | libcommons-fileupload-java | no fix |
| Ubuntu 26.04 LTS | libcommons-fileupload-java | no fix |
| Ubuntu 26.10 | libcommons-fileupload-java | no fix |
| Wolfi | jenkins | 2.395-r0 |
| Wolfi | jenkins-compat | 2.395-r0 |
| Wolfi | jenkins-remoting | 2.395-r0 |
| openSUSE Leap 15.4 | apache-commons-fileupload | 1.5-150200.3.9.1 |
| openSUSE Leap 15.4 | jakarta-commons-fileupload | 1.1.1-150000.4.8.1 |
| openSUSE Leap 15.4 | tomcat | 9.0.75-150200.41.1 |
| openSUSE Leap 15.4 | tomcat | 9.0.43-150200.35.1 |
| openSUSE Leap 15.5 | apache-commons-fileupload | 1.5-150200.3.9.1 |
| openSUSE Leap 15.5 | tomcat | 9.0.75-150200.41.1 |
| openSUSE Tumbleweed | apache-commons-fileupload | 1.5-1.1 |
| openSUSE Tumbleweed | tomcat | 9.0.43-14.1 |
| openSUSE Tumbleweed | tomcat10 | 10.1.14-1.1 |