Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.
Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tomcat-servlet-4.0-apiUpgrade tomcat-el-3.0-apiUpgrade tomcat-docs-webappUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-libUpgrade tomcat-webappsUpgrade tomcatUpgrade tomcat-admin-webapps | Nov 16, 2023 | Feb 20, 2023 |
| Amazon Linux Ami 2 | — | Upgrade tomcat-webappsUpgrade tomcat-docs-webappUpgrade tomcat-el-3.0-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-jsvcUpgrade tomcat-libUpgrade tomcat-servlet-3.1-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-javadocUpgrade tomcatUpgrade tomcat-jsp-2.3-api | Sep 28, 2023 | Feb 20, 2023 |
| Amazon_linux | — | Upgrade tomcat7Upgrade tomcat8 | May 4, 2023 | Feb 20, 2023 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 8.5.85Upgrade Apache Tomcat to 11.0.0Upgrade Apache Tomcat to 10.1.5Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 9.0.71 | Feb 21, 2023 | Feb 20, 2023 |
| Centos_linux | — | Upgrade tomcat-jsp-2.3-apiUpgrade tomcat-el-3.0-apiUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-webappsUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-lib | Nov 8, 2023 | Feb 20, 2023 |
| Debian | — | Upgrade tomcat10Upgrade tomcat9Upgrade libcommons-fileupload-java | Oct 12, 2023 | Feb 20, 2023 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Mar 18, 2023 |
| Freebsd | — | Upgrade jenkinsUpgrade jenkins-lts | Mar 23, 2023 | Mar 9, 2023 |
| Gentoo Linux | — | Upgrade www-servers/tomcat. | May 31, 2023 | Feb 20, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcat-libUpgrade tomcatUpgrade tomcat-servlet-3.0-api | Jun 9, 2023 | Feb 20, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcatUpgrade tomcat-el-3.0-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-servlet-4.0-api | Apr 13, 2023 | Feb 20, 2023 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | May 12, 2023 | Feb 20, 2023 |
| Jenkins 2023 03 08 | — | Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to version 2.375.4Upgrade Jenkins to version 2.394Upgrade Jenkins LTS to the latest version | Jul 23, 2026 | Feb 20, 2023 |
| Oracle Missing Cpu Apr 2023 | — | Apply the April 2023 Critical Patch Update (CPU) for Oracle Database | Apr 27, 2023 | Feb 20, 2023 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 35247514 for version 12.2.1.3.0.Apply the Patch Set Update (PSU) 35227385 for version 14.1.1.0.0. | Aug 6, 2026 | Feb 20, 2023 |
| Oracle_linux | — | Upgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-webappsUpgrade tomcatUpgrade tomcat-el-3.0-apiUpgrade tomcat-libUpgrade tomcat-docs-webapp | Nov 16, 2023 | Feb 20, 2023 |
| Redhat_linux | — | Upgrade tomcat-el-3.0-apiUpgrade tomcat-webappsNo solution existsUpgrade tomcat-libUpgrade tomcatUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-docs-webappUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-admin-webapps | Nov 8, 2023 | Feb 20, 2023 |
| Suse | — | Upgrade tomcat-admin-webappsUpgrade tomcat-servlet-3_1-apiUpgrade apache-commons-fileupload-javadocUpgrade tomcat-webappsUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-javadocUpgrade tomcat-embedUpgrade jakarta-commons-fileupload-javadocUpgrade tomcat-docs-webappUpgrade tomcatUpgrade tomcat-jsp-2_3-apiUpgrade tomcat-jsvcUpgrade jakarta-commons-fileuploadUpgrade tomcat-libUpgrade tomcat-el-3_0-apiUpgrade apache-commons-fileupload | Mar 13, 2023 | Feb 20, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub