CVE-2023-24998

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.

The javax.servlet package lacks support for RFC-1867, HTML file upload. This package provides a simple to use API for working with such data. The scope of this package is to create a package of Java utility classes to read multipart/form-data within a javax.servlet.http.HttpServletRequest.

Security Fix(es):

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.(CVE-2023-24998)

The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open development project

Security Fix(es):

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.

Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.

(CVE-2023-24998)

The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.

(CVE-2023-28709)

Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the next.

Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.

(CVE-2023-42795)

Red Hat Lightwell has released commons-fileupload:commons-fileupload 1.4.0.rhlw-00001 with backported fixes for CVE-2023-24998 and CVE-2025-48976.

CVE-2023-24998: Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts

CVE-2025-48976: Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

This patched artifact is a drop-in replacement for commons-fileupload:commons-fileupload 1.4.0 from Maven Central.

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

• Apache Commons FileUpload: FileUpload DoS with excessive parts (CVE-2023-24998)
• tomcat: not including the secure attribute causes information disclosure (CVE-2023-28708)
• tomcat: Fix for CVE-2023-24998 was incomplete (CVE-2023-28709)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

• Apache Commons FileUpload: FileUpload DoS with excessive parts (CVE-2023-24998)
• tomcat: not including the secure attribute causes information disclosure (CVE-2023-28708)
• tomcat: Fix for CVE-2023-24998 was incomplete (CVE-2023-28709)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• SECURITY UPDATE: Misc vulnerability fixes
  • CVE-2019-12418, CVE-2019-17563, CVE-2020-1935, CVE-2020-11996, CVE-2020-13934, CVE-2020-13935, CVE-2020-13943, CVE-2020-17527, CVE-2021-24122, CVE-2021-30639, CVE-2021-30640, CVE-2021-33037, CVE-2021-42340, CVE-2021-43980, CVE-2022-25762, CVE-2022-34305, CVE-2022-45143, CVE-2023-24998, CVE-2023-28709, CVE-2023-34981, CVE-2023-42794, CVE-2024-21733
• Update to 8.5.100
  • debian/rules, debian/libtomcat8-java.poms, debian/maven.rules, debian/tomcat8-common.links, debian/patches/0018-fix-manager-webapp.patch, debian/patches/0019-add-distribution-to-error-page.patch, debian/patches/0021-dont-test-unsupported-ciphers.patch, debian/patches/0101-skipping-tests-incompatible-with-firewall.patch: updated
  • debian/patches/0002-do-not-load-AJP13-connector-by-default.patch, debian/patches/0026-easymock4-compatibility.patch: removed as they were applied in upstream
  • CVE-2019-0221.patch, CVE-2019-10072-1.patch, CVE-2019-10072-2.patch, CVE-2022-42252.patch, CVE-2020-1938.patch, CVE-2021-25122.patch, CVE-2021-41079.patch, CVE-2022-29885.patch, CVE-2020-9484.patch, CVE-2021-25329-pre1.patch, CVE-2021-25329.patch, CVE-2022-23181.patch, CVE-2023-44487.patch, CVE-2023-46589-pre1.patch, CVE-2023-46589-pre2.patch, CVE-2023-46589-pre3.patch, CVE-2023-46589-pre4.patch, CVE-2023-46589.patch: removed because these CVEs were fixed in upstream
• Internal tests
  • debian/test_certs/*: updated from upstream branch 9.0.x, as the 8.0.x certs were expired

TuxCare rebuilt commons-fileupload:commons-fileupload to address 1 CVE. Fixed in 1.2.2-tuxcare.4.

• CVE-2023-24998: limit number of multipart request parts to prevent DoS

TuxCare rebuilt 4 packages to address 4 CVEs. Fixed in 9.0.50-tuxcare.11.

TuxCare rebuilt 3 packages to address 2 CVEs. Fixed in 9.0.46-tuxcare.10.

TuxCare rebuilt commons-fileupload:commons-fileupload to address 2 CVEs. Fixed in 1.3.1-tuxcare.2.

TuxCare rebuilt 32 packages to address 16 CVEs. Fixed in 7.0.70-tuxcare.4.

TuxCare rebuilt 8 packages to address 32 CVEs. Fixed in 9.0.24-tuxcare.1.

TuxCare rebuilt 5 packages to address 26 CVEs. Fixed in 9.0.39-tuxcare.2.

TuxCare rebuilt 7 packages to address 22 CVEs. Fixed in 9.0.13-tuxcare.2.

Denial of service with a malicious upload or series of uploads. (CVE-2023-24998)

Information disclosure due to concurrency bug (CVE-2021-43980) Fix for CVE-2020-9484 introduced a time of check, time of use vulnerability (CVE-2022-23181) Correct documentation to warn of use over untrusted networks. (CVE-2022-29885) Correct documentation showing use of XSS vulnerability. (CVE-2022-34305) Fix to reject invalid Content-Length header (CVE-2022-42252) Fix escaping of the type, message or description values. (CVE-2022-45143) Fix FileUpload limiting of the number of request parts to be processed to prevent the possibility of an attacker triggering a DoS (CVE-2023-24998) Fix setting of session cookie secure attribute when using RemoteIpFilter with X-Forwarded-Proto header set to https (CVE-2023-28708) Obsolete tomcat-jsvc

These are all security issues fixed in the tomcat-9.0.43-14.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the apache-commons-fileupload-1.5-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the tomcat10-10.1.14-1.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2023-24998 in the io.root.org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available.

This update for tomcat fixes the following issues:

• CVE-2023-24998: Fixed FileUpload DoS with excessive parts (bsc#1208513).

This update for tomcat fixes the following issues:

• CVE-2023-24998: Fixed FileUpload DoS with excessive parts (bsc#1208513).

This update for tomcat fixes the following issues:

• CVE-2023-24998: Fixed FileUpload DoS with excessive parts (bsc#1208513).

This update for jakarta-commons-fileupload fixes the following issues:

• CVE-2016-3092: Fixed a usage of vulnerable FileUpload package can result in denial of service (bsc#986359).
• CVE-2023-24998: Fixed a FileUpload deny of service with excessive parts (bsc#1208513).

This update for jakarta-commons-fileupload fixes the following issues:

• CVE-2016-3092: Fixed a usage of vulnerable FileUpload package can result in denial of service (bsc#986359).
• CVE-2023-24998: Fixed a FileUpload deny of service with excessive parts (bsc#1208513).

This update for tomcat fixes the following issues:

• CVE-2023-28708: Fixed information disclosure by not including the secure attribute (bsc#1209622).
• CVE-2023-24998: Fixed FileUpload deny-of-service with excessive parts (bsc#1208513).

This update for apache-commons-fileupload fixes the following issues:

Updated to version 1.5:

• CVE-2023-24998: Added a configurable maximum number of files to upload per request (bsc#1208513).

This update for tomcat fixes the following issues:

Updated to version 9.0.75:

• CVE-2023-28709: Mended an incomplete fix for CVE-2023-24998 (bsc#1208513, bsc#1211608).

This update for tomcat fixes the following issues:

Update to Tomcat 9.0.115:

• CVE-2025-48989: HTTP/2 protocol (including DNS over HTTPS) is vulnerable to 'MadeYouReset' DoS attack (bsc#1243895).
• CVE-2025-52434: race condition on connection close when using the APR/Native connector could lead to a JVM crash (bsc#1246389).
• CVE-2025-53506: uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318).
• CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
• CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
• CVE-2023-44487: Rapid reset attack (bsc#1216182).