The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tomcat-servlet-4.0-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-admin-webappsUpgrade tomcat-docs-webappUpgrade tomcat-libUpgrade tomcat-el-3.0-apiUpgrade tomcatUpgrade tomcat-webapps | Nov 16, 2023 | May 22, 2023 |
| Amazon Linux Ami 2 | — | Upgrade tomcatUpgrade tomcat-jsvcUpgrade tomcat-webappsUpgrade tomcat-el-3.0-apiUpgrade tomcat-libUpgrade tomcat-el-2.2-apiUpgrade tomcat-servlet-3.1-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-docs-webappUpgrade tomcat-javadoc | Sep 28, 2023 | May 22, 2023 |
| Amazon_linux | — | Upgrade tomcat8 | Jul 20, 2023 | May 22, 2023 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 10.1.8Upgrade Apache Tomcat to 11.0.0Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 9.0.74Upgrade Apache Tomcat to 8.5.88 | May 23, 2023 | May 22, 2023 |
| Centos_linux | — | Upgrade tomcat-webappsUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcat-el-3.0-apiUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-servlet-4.0-api | Nov 8, 2023 | May 22, 2023 |
| Debian | — | Upgrade tomcat10 | Oct 19, 2023 | May 22, 2023 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Jun 29, 2023 |
| Gentoo Linux | — | Upgrade www-servers/tomcat. | May 31, 2023 | May 22, 2023 |
| Oracle_linux | — | Upgrade tomcat-libUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-el-3.0-apiUpgrade tomcat-webappsUpgrade tomcatUpgrade tomcat-docs-webapp | Nov 16, 2023 | May 22, 2023 |
| Redhat_linux | — | Upgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-servlet-4.0-apiNo solution existsUpgrade tomcat-docs-webappUpgrade tomcat-webappsUpgrade tomcat-el-3.0-apiUpgrade tomcat | Nov 8, 2023 | May 22, 2023 |
| Suse | — | Upgrade tomcat-servlet-3_1-apiUpgrade tomcat-javadocUpgrade tomcatUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-libUpgrade tomcat-embedUpgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade tomcat-docs-webappUpgrade tomcat-jsp-2_3-apiUpgrade tomcat-jsvcUpgrade tomcat-el-3_0-api | May 31, 2023 | May 22, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 22, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub