Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.
Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tomcat-webappsUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-el-3.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcat-docs-webappUpgrade tomcatUpgrade tomcat-servlet-4.0-api | Nov 16, 2023 | Feb 20, 2023 |
| Amazon Linux Ami 2 | — | Upgrade tomcat-el-3.0-apiUpgrade tomcat-docs-webappUpgrade tomcat-webappsUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcatUpgrade tomcat-javadocUpgrade tomcat-jsvcUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-servlet-3.1-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-lib | Sep 28, 2023 | Feb 20, 2023 |
| Amazon_linux | — | Upgrade tomcat7Upgrade tomcat8 | May 4, 2023 | Feb 20, 2023 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 8.5.85Upgrade Apache Tomcat to 9.0.71Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 10.1.5Upgrade Apache Tomcat to 11.0.0 | Feb 21, 2023 | Feb 20, 2023 |
| Centos_linux | — | Upgrade tomcat-el-3.0-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade tomcat-lib | Nov 8, 2023 | Feb 20, 2023 |
| Debian | — | Upgrade tomcat10Upgrade libcommons-fileupload-javaUpgrade tomcat9 | Oct 12, 2023 | Feb 20, 2023 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Mar 18, 2023 |
| Freebsd | — | Upgrade jenkins-ltsUpgrade jenkins | Mar 23, 2023 | Mar 9, 2023 |
| Gentoo Linux | — | Upgrade www-servers/tomcat. | May 31, 2023 | Feb 20, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade tomcat-servlet-3.0-apiUpgrade tomcat-libUpgrade tomcatUpgrade tomcat-el-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade tomcat-jsp-2.2-api | Jun 9, 2023 | Feb 20, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-el-3.0-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat | Apr 13, 2023 | Feb 20, 2023 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | May 12, 2023 | Feb 20, 2023 |
| Jenkins 2023 03 08 | — | Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to the latest versionUpgrade Jenkins to version 2.394Upgrade Jenkins LTS to version 2.375.4 | Jul 23, 2026 | Feb 20, 2023 |
| Oracle Missing Cpu Apr 2023 | — | Apply the April 2023 Critical Patch Update (CPU) for Oracle Database | Apr 27, 2023 | Feb 20, 2023 |
| Oracle_linux | — | Upgrade tomcat-el-3.0-apiUpgrade tomcatUpgrade tomcat-libUpgrade tomcat-docs-webappUpgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-servlet-4.0-api | Nov 16, 2023 | Feb 20, 2023 |
| Redhat_linux | — | Upgrade tomcat-docs-webappUpgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-el-3.0-apiNo solution exists | Nov 8, 2023 | Feb 20, 2023 |
| Suse | — | Upgrade jakarta-commons-fileupload-javadocUpgrade tomcat-javadocUpgrade tomcat-embedUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-admin-webappsUpgrade apache-commons-fileupload-javadocUpgrade tomcat-webappsUpgrade tomcat-jsp-2_3-apiUpgrade apache-commons-fileuploadUpgrade tomcat-el-3_0-apiUpgrade jakarta-commons-fileuploadUpgrade tomcat-libUpgrade tomcat-jsvc | Mar 13, 2023 | Feb 20, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub