vulnerability

Apache Tomcat: Important: Apache Tomcat denial of service (CVE-2023-24998)

Try Surface Command

Back to search

Severity	CVSS	Published	Added	Modified
8	(AV:N/AC:L/Au:N/C:N/I:N/A:C)	Feb 21, 2023	Feb 21, 2023	Aug 11, 2025

Severity

CVSS

(AV:N/AC:L/Au:N/C:N/I:N/A:C)

Published

Feb 21, 2023

Added

Feb 21, 2023

Modified

Aug 11, 2025

Description

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.

Note that, like all of the file upload limits, the
new configuration option (FileUploadBase#setFileCountMax) is not
enabled by default and must be explicitly configured.

Solutions

apache-tomcat-upgrade-10_1_5apache-tomcat-upgrade-8_5_85apache-tomcat-upgrade-9_0_71

References

CVE-2023-24998
https://attackerkb.com/topics/CVE-2023-24998
CWE-770
URL-http://tomcat.apache.org/security-10.html
URL-http://tomcat.apache.org/security-8.html
URL-http://tomcat.apache.org/security-9.html

NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today