Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2023-24998

Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Commons FileUpload

Default version status: unaffected

  • 0 to < 1.5affected

Apache Software Foundation Apache Tomcat

Default version status: unaffected

  • 11.0.0-M1affected
  • 10.0.0-M1 to ≤ 10.1.4affected
  • 9.0.0-M1 to ≤ 9.0.70affected
  • 8.5.0 to ≤ 8.5.84affected

References