Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.
Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tomcat-servlet-4.0-apiUpgrade tomcat-docs-webappUpgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-el-3.0-apiUpgrade tomcatUpgrade tomcat-lib | Nov 16, 2023 | Feb 20, 2023 |
| Amazon Linux Ami 2 | — | Upgrade tomcatUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-javadocUpgrade tomcat-libUpgrade tomcat-jsvcUpgrade tomcat-el-2.2-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-servlet-3.1-apiUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-docs-webappUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-el-3.0-apiUpgrade tomcat-webapps | Sep 28, 2023 | Feb 20, 2023 |
| Amazon_linux | — | Upgrade tomcat7Upgrade tomcat8 | May 4, 2023 | Feb 20, 2023 |
| Apache Tomcat | — | Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 9.0.71Upgrade Apache Tomcat to 10.1.5Upgrade Apache Tomcat to 11.0.0Upgrade Apache Tomcat to 8.5.85 | Feb 21, 2023 | Feb 20, 2023 |
| Centos_linux | — | Upgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcat-webappsUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-docs-webappUpgrade tomcat-el-3.0-apiUpgrade tomcatUpgrade tomcat-jsp-2.3-api | Nov 8, 2023 | Feb 20, 2023 |
| Debian | — | Upgrade libcommons-fileupload-javaUpgrade tomcat9Upgrade tomcat10 | Oct 12, 2023 | Feb 20, 2023 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Mar 18, 2023 |
| Freebsd | — | Upgrade jenkinsUpgrade jenkins-lts | Mar 23, 2023 | Mar 9, 2023 |
| Gentoo Linux | — | Upgrade www-servers/tomcat. | May 31, 2023 | Feb 20, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade tomcat-jsp-2.2-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-libUpgrade tomcat | Jun 9, 2023 | Feb 20, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-servlet-4.0-apiUpgrade tomcat-el-3.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcatUpgrade tomcat-jsp-2.3-api | Apr 13, 2023 | Feb 20, 2023 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | May 12, 2023 | Feb 20, 2023 |
| Jenkins 2023 03 08 | — | Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to the latest versionUpgrade Jenkins to version 2.394Upgrade Jenkins LTS to version 2.375.4 | Jul 23, 2026 | Feb 20, 2023 |
| Oracle Missing Cpu Apr 2023 | — | Apply the April 2023 Critical Patch Update (CPU) for Oracle Database | Apr 27, 2023 | Feb 20, 2023 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 35227385 for version 14.1.1.0.0.Apply the Patch Set Update (PSU) 35247514 for version 12.2.1.3.0. | Aug 6, 2026 | Feb 20, 2023 |
| Oracle_linux | — | Upgrade tomcat-el-3.0-apiUpgrade tomcat-libUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-webappsUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-admin-webapps | Nov 16, 2023 | Feb 20, 2023 |
| Redhat_linux | — | Upgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-docs-webappUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-el-3.0-apiNo solution exists | Nov 8, 2023 | Feb 20, 2023 |
| Suse | — | Upgrade tomcat-admin-webappsUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-embedUpgrade tomcat-javadocUpgrade tomcat-webappsUpgrade tomcat-servlet-4_0-apiUpgrade jakarta-commons-fileupload-javadocUpgrade apache-commons-fileupload-javadocUpgrade tomcat-servlet-3_1-apiUpgrade jakarta-commons-fileuploadUpgrade tomcat-libUpgrade apache-commons-fileuploadUpgrade tomcat-jsp-2_3-apiUpgrade tomcat-el-3_0-apiUpgrade tomcat-jsvc | Mar 13, 2023 | Feb 20, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub