Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.
Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tomcat-servlet-4.0-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-admin-webappsUpgrade tomcat-docs-webappUpgrade tomcat-el-3.0-apiUpgrade tomcat-webappsUpgrade tomcatUpgrade tomcat-lib | Nov 16, 2023 | Feb 20, 2023 |
| Amazon Linux Ami 2 | — | Upgrade tomcat-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-el-3.0-apiUpgrade tomcat-docs-webappUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-servlet-3.1-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-el-2.2-apiUpgrade tomcatUpgrade tomcat-jsvcUpgrade tomcat-javadocUpgrade tomcat-lib | Sep 28, 2023 | Feb 20, 2023 |
| Amazon_linux | — | Upgrade tomcat7Upgrade tomcat8 | May 4, 2023 | Feb 20, 2023 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 8.5.85Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 11.0.0Upgrade Apache Tomcat to 10.1.5Upgrade Apache Tomcat to 9.0.71 | Feb 21, 2023 | Feb 20, 2023 |
| Centos_linux | — | Upgrade tomcatUpgrade tomcat-webappsUpgrade tomcat-el-3.0-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-docs-webappUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-libUpgrade tomcat-admin-webapps | Nov 8, 2023 | Feb 20, 2023 |
| Debian | — | Upgrade tomcat10Upgrade tomcat9Upgrade libcommons-fileupload-java | Oct 12, 2023 | Feb 20, 2023 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Mar 18, 2023 |
| Freebsd | — | Upgrade jenkins-ltsUpgrade jenkins | Mar 23, 2023 | Mar 9, 2023 |
| Gentoo Linux | — | Upgrade www-servers/tomcat. | May 31, 2023 | Feb 20, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade tomcat-servlet-3.0-apiUpgrade tomcatUpgrade tomcat-libUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcat-admin-webapps | Jun 9, 2023 | Feb 20, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-jsp-2.3-apiUpgrade tomcat-el-3.0-apiUpgrade tomcatUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-lib | Apr 13, 2023 | Feb 20, 2023 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | May 12, 2023 | Feb 20, 2023 |
| Jenkins 2023 03 08 | — | Upgrade Jenkins LTS to version 2.375.4Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to the latest versionUpgrade Jenkins to version 2.394 | Jul 23, 2026 | Feb 20, 2023 |
| Oracle Missing Cpu Apr 2023 | — | Apply the April 2023 Critical Patch Update (CPU) for Oracle Database | Apr 27, 2023 | Feb 20, 2023 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 35227385 for version 14.1.1.0.0.Apply the Patch Set Update (PSU) 35247514 for version 12.2.1.3.0. | Aug 6, 2026 | Feb 20, 2023 |
| Oracle_linux | — | Upgrade tomcat-jsp-2.3-apiUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcatUpgrade tomcat-el-3.0-apiUpgrade tomcat-docs-webapp | Nov 16, 2023 | Feb 20, 2023 |
| Redhat_linux | — | No solution existsUpgrade tomcat-webappsUpgrade tomcat-el-3.0-apiUpgrade tomcat-libUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-admin-webappsUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-jsp-2.3-api | Nov 8, 2023 | Feb 20, 2023 |
| Suse | — | Upgrade apache-commons-fileuploadUpgrade jakarta-commons-fileuploadUpgrade tomcat-libUpgrade tomcat-jsvcUpgrade tomcat-el-3_0-apiUpgrade tomcat-jsp-2_3-apiUpgrade jakarta-commons-fileupload-javadocUpgrade tomcat-servlet-4_0-apiUpgrade tomcatUpgrade tomcat-docs-webappUpgrade apache-commons-fileupload-javadocUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade tomcat-javadocUpgrade tomcat-embed | Mar 13, 2023 | Feb 20, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub