Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.
Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcat-webappsUpgrade tomcat-docs-webappUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-el-3.0-apiUpgrade tomcat-servlet-4.0-api | Nov 16, 2023 | Feb 20, 2023 |
| Amazon Linux Ami 2 | — | Upgrade tomcat-jsp-2.2-apiUpgrade tomcatUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-libUpgrade tomcat-servlet-3.1-apiUpgrade tomcat-javadocUpgrade tomcat-jsvcUpgrade tomcat-el-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-docs-webappUpgrade tomcat-webappsUpgrade tomcat-el-3.0-api | Sep 28, 2023 | Feb 20, 2023 |
| Amazon_linux | — | Upgrade tomcat8Upgrade tomcat7 | May 4, 2023 | Feb 20, 2023 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 9.0.71Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 10.1.5Upgrade Apache Tomcat to 11.0.0Upgrade Apache Tomcat to 8.5.85 | Feb 21, 2023 | Feb 20, 2023 |
| Centos_linux | — | Upgrade tomcatUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-el-3.0-apiUpgrade tomcat-webappsUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-docs-webappUpgrade tomcat-libUpgrade tomcat-admin-webapps | Nov 8, 2023 | Feb 20, 2023 |
| Debian | — | Upgrade tomcat10Upgrade tomcat9Upgrade libcommons-fileupload-java | Oct 12, 2023 | Feb 20, 2023 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Mar 18, 2023 |
| Freebsd | — | Upgrade jenkinsUpgrade jenkins-lts | Mar 23, 2023 | Mar 9, 2023 |
| Gentoo Linux | — | Upgrade www-servers/tomcat. | May 31, 2023 | Feb 20, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-libUpgrade tomcat | Jun 9, 2023 | Feb 20, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-el-3.0-apiUpgrade tomcatUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-jsp-2.3-api | Apr 13, 2023 | Feb 20, 2023 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | May 12, 2023 | Feb 20, 2023 |
| Jenkins 2023 03 08 | — | Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to the latest versionUpgrade Jenkins LTS to version 2.375.4Upgrade Jenkins to version 2.394 | Jul 23, 2026 | Feb 20, 2023 |
| Oracle Missing Cpu Apr 2023 | — | Apply the April 2023 Critical Patch Update (CPU) for Oracle Database | Apr 27, 2023 | Feb 20, 2023 |
| Oracle_linux | — | Upgrade tomcat-docs-webappUpgrade tomcat-libUpgrade tomcat-el-3.0-apiUpgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-webappsUpgrade tomcat-servlet-4.0-api | Nov 16, 2023 | Feb 20, 2023 |
| Redhat_linux | — | Upgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-el-3.0-apiNo solution existsUpgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-docs-webappUpgrade tomcat-servlet-4.0-api | Nov 8, 2023 | Feb 20, 2023 |
| Suse | — | Upgrade tomcat-jsp-2_3-apiUpgrade jakarta-commons-fileuploadUpgrade apache-commons-fileuploadUpgrade tomcat-libUpgrade tomcat-jsvcUpgrade tomcat-el-3_0-apiUpgrade tomcat-embedUpgrade tomcat-javadocUpgrade tomcat-webappsUpgrade tomcatUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-docs-webappUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-3_1-apiUpgrade apache-commons-fileupload-javadocUpgrade jakarta-commons-fileupload-javadoc | Mar 13, 2023 | Feb 20, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub